GPAC MP4Box Scene Command Graph UAF (CWE-416) SEGV

Vulnerability Overview Vulnerability Name: GPAC MP4Box SEGV in (Use-After-Free) Project: gpac/gpac Version: The vulnerability exists in commit (master, 2026-07-25) and was fixed when the issue was closed (2026-07-28) Severity: MEDIUM CWE: CWE-416 - Use After Free Root Cause: GPAC does not persistently manage the list of scene graph command graph nodes. When MP4Box processes a malicious MP4 file, the scene command graph frees the node list, but subsequent commands still reference the already-freed list, causing to access freed memory and triggering a SEGV. Scope of Impact Affected Files: ( ) Impact: A malicious MP4 file can trigger a use-after-free in MP4Box when using the option, leading to process crash and service interruption. Code execution cannot be ruled out. Fix Apply the upstream fix, which properly manages the lifecycle of the node list during scene command application, preventing access to freed memory. POC / Reproduction Code Reproduction Steps: Expected Crash Output (ASan Report): ``` ==1300==ERROR: AddressSanitizer: SEGV on unknown address 0x (pc 0x7f231aa28f4 sp 0xff7f231aa8020 bp 0xff7f231a ==1300==The signal was caused by a READ memory access. ==1300==This fault was caused by a dereference of a high value address (see register values below). Disassemble t pc=0x7f231aa8a40 in gf_list_find_util(list.c:776) r2=0x7f231aa8a40 in gf_list_find_util(list.c:776) r3=0x7f231aa8a40 in gf_list_find_util(list.c:776) r5=0x7f231aa8a40 in gf_list_find_util(list.c:776) r7=0x7f231aa8a40 in gf_list_find_util(list.c:776) r8=0x7f231aa8a40 in gf_list_find_util(list.c:776) r9=0x7f231aa8a40 in gf_list_find_util(list.c:776) r10=0x7f231aa8a40 in gf_list_find_util(list.c:776) r11=0x7f231aa8a40 in gf_list_find_util(list.c:776) r12=0x7f231aa8a40 in gf_list_find_util(list.c:776) r13=0x7f231aa8a40 in gf_list_find_util(list.c:776) r14=0x7f231aa8a40 in gf_list_find_util(list.c:776) r15=0x7f231aa8a40 in gf_list_find_util(list.c:776) r16=0x7f231aa8a40 in gf_list_find_util(list.c:776) r17=0x7f231aa8a40 in gf_list_find_util(list.c:776) r18=0x7f231aa8a40 in gf_list_find_util(list.c:776) r19=0x7f231aa8a40 in gf_list_find_util(list.c:776) r20=0x7f231aa8a40 in gf_list_find_util(list.c:776) r21=0x7f231aa8a40 in gf_list_find_util(list.c:776) r22=0x7f231aa8a40 in gf_list_find_util(list.c:776) r23=0x7f231aa8a40 in gf_list_find_util(list.c:776) r24=0x7f231aa8a40 in gf_list_find_util(list.c:776) r25=0x7f231aa8a40 in gf_list_find_util(list.c:776) r26=0x7f231aa8a40 in gf_list_find_util(list.c:776) r27=0x7f231aa8a40 in gf_list_find_util(list.c:776) r28=0x7f231aa8a40 in gf_list_find_util(list.c:776) r29=0x7f231aa8a40 in gf_list_find_util(list.c:776) r30=0x7f231aa8a40 in gf_list_find_util(list.c:776) r31=0x7f231aa8a40 in gf_list_find_util(list.c:776) r32=0x7f231aa8a40 in gf_list_find_util(list.c:776) r33=0x7f231aa8a40 in gf_list_find_util(list.c:776) r34=0x7f231aa8a40 in gf_list_find_util(list.c:776) r35=0x7f231aa8a40 in gf_list_find_util(list.c:776) r36=0x7f231aa8a40 in gf_list_find_util(list.c:776) r37=0x7f231aa8a40 in gf_list_find_util(list.c:776) r38=0x7f231aa8a40 in gf_list_find_util(list.c:776) r39=0x7f231aa8a40 in gf_list_find_util(list.c:776) r40=0x7f231aa8a40 in gf_list_find_util(list.c:776) r41=0x7f231aa8a40 in gf_list_find_util(list.c:776) r42=0x7f231aa8a40 in gf_list_find_util(list.c:776) r43=0x7f231aa8a40 in gf_list_find_util(list.c:776) r44=0x7f231aa8a40 in gf_list_find_util(list.c:776) r45=0x7f231aa8a40 in gf_list_find_util(list.c:776) r46=0x7f231aa8a40 in gf_list_find_util(list.c:776) r47=0x7f231aa8a40 in gf_list_find_util(list.c:776) r48=0x7f231aa8a40 in gf_list_find_util(list.c:776) r49=0x7f231aa8a40 in gf_list_find_util(list.c:776) r50=0x7f231aa8a40 in gf_list_find_util(list.c:776) r51=0x7f231aa8a40 in gf_list_find_util(list.c:776) r52=0x7f231aa8a40 in gf_list_find_util(list.c:776) r53=0x7f231aa8a40 in gf_list_find_util(list.c:776) r54=0x7f231aa8a40 in gf_list_find_util(list.c:776) r55=0x7f231aa8a40 in gf_list_find_util(list.c:776) r56=0x7f231aa8a40 in gf_list_find_util(list.c:776) r57=0x7f231aa8a40 in gf_list_find_util(list.c:776) r58=0x7f231aa8a40 in gf_list_find_util(list.c:776) r59=0x7f231aa8a40 in gf_list_find_util(list.c:776) r60=0x7f231aa8a40 in gf_list_find_util(list.c:776) r61=0x7f231aa8a40 in gf_list_find_util(list.c:776) r62=0x7f231aa8a40 in gf_list_find_util(list.c:776) r63=0x7f231aa8a40 in gf_list_find_util(list.c:776) r64=0x7f231aa8a40 in gf_list_find_util(list.c:776) r65=0x7f231aa8a40 in gf_list_find_util(list.c:776) r66=0x7f231aa8a40 in gf_list_find_util(list.c:776) r67=0x7f231aa8a40 in gf_list_find_util(list.c:776) r68=0x7f231aa8a40 in gf_list_find_util(list.c:776) r69=0x7f231aa8a40 in gf_list_find_util(list.c:776) r70=0x7f231aa8a40 in gf_list_find_util(list.c:776) r71=0x7f231aa8a40 in gf_list_find_util(list.c:776) r72=0x7f231aa8a40 in gf_list_find_util(list.c:776) r73=0x7f231aa8a40 in gf_list_find_util(list.c:776) r74=0x7f231aa8a40 in gf_list_find_util(list.c:776) r75=0x7f231aa8a40 in gf_list_find_util(list

Goal Reached Thanks to every supporter — we hit 100%!

GPAC MP4Box Scene Command Graph UAF (CWE-416) SEGV

More from this source