CVE-2026-108539: GPAC MP4Box Use-After-Free Vulnerability

CVE-2026-108539 Overview

CVE-2026-108539 is a use-after-free vulnerability in GPAC through version 26.07.0. The flaw resides in the gf_fq_pop function within filter_core/filter_queue.c, part of the MP4Box component. An attacker can trigger the condition remotely by delivering a crafted media file that the victim processes with MP4Box. A public proof-of-concept exists, and the vendor did not respond to the initial disclosure attempt. The weakness is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Successful exploitation can cause memory corruption in MP4Box, enabling denial of service and potentially influencing process memory when a user opens a malicious media file.

Affected Products

GPAC Framework versions up to and including 26.07.0
MP4Box multimedia packaging utility shipped with GPAC
Downstream distributions bundling vulnerable GPAC builds

Discovery Timeline

2026-10-11 - CVE-2026-108539 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108539

Vulnerability Analysis

The defect occurs in gf_fq_pop, a queue-pop routine inside GPAC's filter core. The function returns a reference to a queue element whose backing memory has already been released. Subsequent reads or writes against that stale pointer produce a use-after-free condition. Because MP4Box orchestrates filters while parsing containers such as MP4, 3GP, and other ISO base media files, a crafted input can steer the filter queue into a state where a freed node is reused.

The filter pipeline operates during normal file packaging, demuxing, and remuxing operations. An attacker only needs the target to run MP4Box against the malicious file. User interaction is required, but no authentication is needed.

Root Cause

The root cause is improper lifecycle management of queue nodes in filter_core/filter_queue.c. The code path pops an element without ensuring that references held elsewhere in the filter graph are invalidated before memory is freed. This matches the [CWE-119] pattern of operating outside the intended buffer lifetime.

Attack Vector

Exploitation is remote in the sense that the malicious artifact can be delivered over any channel including email, web download, or shared storage. The victim must process the file with a vulnerable MP4Box binary or an application that embeds the GPAC filter engine. A proof-of-concept archive is publicly hosted on the GitHub PoC attachment, and additional technical context is tracked under VulDB entry 416194.

A synthetic exploit snippet is not reproduced here. Analysts should review the published PoC and the gf_fq_pop implementation in the GPAC source tree for triage.

Detection Methods for CVE-2026-108539

Indicators of Compromise

Unexpected crashes, aborts, or AddressSanitizer errors from MP4Box referencing gf_fq_pop or filter_queue.c.
Core dumps generated by media processing pipelines that ingest untrusted MP4, 3GP, or ISO base media files.
Execution of MP4Box with command-line arguments pointing to files sourced from external or unverified locations.

Detection Strategies

Monitor process telemetry for MP4Box child processes spawning shells, scripts, or network utilities after processing media.
Deploy fuzzing harnesses against the GPAC filter queue to surface additional use-after-free paths before adversaries do.
Hunt for file-write events producing .mp4, .3gp, or .iso files immediately followed by MP4Box invocations in automated conversion workflows.

Monitoring Recommendations

Enable crash reporting on servers and workstations that run GPAC in batch transcoding roles.
Capture command-line arguments and parent-child process relationships for every MP4Box execution.
Log file hashes of input media processed by GPAC so suspected PoC samples can be retrospectively identified.

How to Mitigate CVE-2026-108539

Immediate Actions Required

Inventory every system that ships MP4Box or links the GPAC libraries and record the installed version.
Restrict MP4Box processing to trusted inputs until a fixed build is available from the GPAC project.
Isolate transcoding workloads behind sandboxing or containerization so a crash in gf_fq_pop cannot pivot into the host.

Patch Information

The GPAC maintainers had not published a vendor advisory at the time CVE-2026-108539 was recorded. Track the VulDB CVE record and the GPAC project repository for an upstream commit that corrects the gf_fq_pop lifetime handling. Rebuild dependent packages once a patched release is tagged.

Workarounds

Disable automated MP4Box processing of files received from untrusted senders or external uploaders.
Run MP4Box under a dedicated low-privilege account with no network egress to limit downstream abuse.
Apply seccomp, AppArmor, or SELinux profiles that constrain the syscalls available to the filter pipeline.
Where source builds are feasible, compile GPAC with AddressSanitizer in staging environments to detect exploitation attempts early.

bash

# Configuration example: run MP4Box inside a restricted sandbox
systemd-run --uid=mp4box --gid=mp4box \
  --property=NoNewPrivileges=yes \
  --property=PrivateNetwork=yes \
  --property=ProtectSystem=strict \
  --property=ProtectHome=yes \
  /usr/bin/MP4Box -info /var/incoming/untrusted.mp4