GPAC MP4Box Heap Use-After-Free (CVE-3800) Root Cause, ASan Trace & PoC

GPAC MP4Box Heap Use-After-Free Vulnerability (CVE-3800) Vulnerability Overview Vulnerability Name: Heap Use-After-Free in in GPAC MP4Box Severity: HIGH CWE: CWE-416 - Use After Free OWASP: N/A - Native File Parsing Memory Corruption Affected Files: - ( , ) - (xscene teardown path) - (filter finalization path) Scope of Impact Project: GPAC (https://github.com/gpac/gpac) Vulnerable Version: Commit (before commit ) Fixed Version: Commit Impact: Malformed scenegraph files can corrupt the scenegraph lifecycle state, causing MP4Box to crash. Through processing, service, or batch workflows, untrusted scenegraph descriptors can lead to a Denial of Service. The heap use-after-free in specific execution contexts may lead to more severe memory corruption consequences. Root Cause During the destruction of a malformed scenegraph, unregisters the old node before notifying the parent node via . The unregistration destroys the node and its associated prototype tree. Subsequently, when the notification traverses the scenegraph state, it accesses the destroyed node, resulting in a heap use-after-free. Fix Apply upstream commit , or upgrade to a newer GPAC version. The fix ensures that the propagation of changes occurs before the replaced node is unregistered and potentially freed. Regression tests should cover malformed scenegraph destruction (under AddressSanitizer), not just the initial parsing phase. Reproduction Steps POC / Exploit Code References GPAC issue #3800: https://github.com/gpac/gpac/issues/3800 Fix commit: https://github.com/gpac/gpac/commit/9ea404f448888da6ca3545657c6874f7f0624 Vulnerable commit: https://github.com/gpac/gpac/commit/f2129cde1a929d913ac85f7d97324ec94c2a9f15 Reproduction materials: https://github.com/Echo6/CVE_submit

Goal Reached Thanks to every supporter — we hit 100%!

GPAC MP4Box Heap Use-After-Free (CVE-3800) Root Cause, ASan Trace & PoC

More from this source