CVE-2026-92473: GPAC Use After Free Vulnerability

CVE-2026-92473 Overview

CVE-2026-92473 is a use-after-free vulnerability [CWE-119] in GPAC version 26.08-DEV. The flaw resides in the gf_sg_command_del function within src/scenegraph/commands.c, part of the Binary Format for Scenes (BIFS) Handler component. An attacker with local access can trigger memory reuse after deallocation by supplying a crafted scene graph command. A public proof-of-concept exists, though no exploitation in the wild has been reported. GPAC maintainers resolved the issue in release abi-16.24 through commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7.

Critical Impact
Local attackers processing untrusted BIFS scene content through GPAC can trigger memory corruption, potentially leading to process crash or arbitrary code execution within the context of the parsing application.

Affected Products

GPAC 26.08-DEV
GPAC BIFS Handler component (src/scenegraph/commands.c)
Applications embedding vulnerable GPAC libraries for MPEG-4 scene parsing

Discovery Timeline

2026-09-16 - CVE-2026-92473 published to NVD
2026-09-16 - Last updated in NVD database
Patch commit - e34f4ba349d55cd1849f0bcf4cf46552732e2db7 merged into GPAC repository
Fixed release - GPAC abi-16.24 published

Technical Details for CVE-2026-92473

Vulnerability Analysis

The vulnerability affects the BIFS command deletion routine gf_sg_command_del in GPAC's scene graph subsystem. BIFS is a binary encoding format for MPEG-4 scene descriptions that references nodes through commands and route identifiers. The vulnerable code path involves unresolved commands that hold pointers to scene graph nodes without proper reference counting.

When the parser resolves a node reference via gf_sg_find_node, it previously assigned the pointer directly to com->node without invoking the node reference management helper. If the resolved node was later freed, gf_sg_command_del would operate on a dangling pointer, producing memory corruption when the command was destroyed.

Root Cause

The root cause is improper lifetime management of scene graph node references stored in GF_Command structures. Direct pointer assignment bypassed the reference tracking layer that gf_sg_command_set_node provides, leaving commands linked to nodes that could be deallocated independently. A secondary issue in base_scenegraph.c failed to preserve the deactivation state of nodes during recursive traversal, allowing cyclic or malformed scene graphs to reach freed memory.

Attack Vector

Exploitation requires local access and the ability to submit a crafted BIFS scene file to a GPAC-based parser. The attacker supplies a malformed scene graph containing unresolved commands referencing nodes that will be freed during processing. When GPAC subsequently tears down the command list, the use-after-free is triggered inside gf_sg_command_del.

// Patch: src/laser/lsr_dec.c - proper node reference handling
for (i=0; i<gf_list_count(codec->unresolved_commands); i++) {
    GF_Command *com = (GF_Command *)gf_list_get(codec->unresolved_commands, i);
    gf_assert(!com->node);
-   com->node = gf_sg_find_node(codec->sg, com->RouteID);
-   if (com->node) {
+   GF_Node *n = gf_sg_find_node(codec->sg, com->RouteID);
+   if (n) {
+       gf_sg_command_set_node(com, n);
        gf_node_register(com->node, NULL);
        com->RouteID = 0;
        gf_list_rem(codec->unresolved_commands, i);

Source: GitHub Commit e34f4ba

The patch replaces the raw pointer assignment with gf_sg_command_set_node, ensuring the command participates in the reference management scheme. A companion change in base_scenegraph.c preserves the prior deactivation flag so cyclic traversal cannot revisit freed nodes.

Detection Methods for CVE-2026-92473

Indicators of Compromise

Unexpected crashes of MP4Box, MP4Client, or other GPAC-derived binaries when parsing scene content
Presence of malformed BIFS or LASeR files in temporary directories or media pipelines
Segmentation faults referencing gf_sg_command_del or gf_node_unregister in core dumps

Detection Strategies

Enumerate installed GPAC versions across build systems and media processing hosts and compare against abi-16.24
Enable AddressSanitizer builds of GPAC in test environments to surface use-after-free conditions during fuzzing
Inventory third-party applications that bundle libgpac to identify downstream exposure

Monitoring Recommendations

Log invocations of GPAC command-line tools on multi-user systems and flag unusual scene file inputs
Correlate process crashes of media parsers with recently accessed BIFS content
Monitor package management events for installations of vulnerable GPAC versions

How to Mitigate CVE-2026-92473

Immediate Actions Required

Upgrade GPAC to release abi-16.24 or later on all systems that parse untrusted scene content
Audit downstream applications and container images that embed libgpac and rebuild against the patched release
Restrict BIFS parsing to trusted input sources until upgrades complete

Patch Information

The fix is available in commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7 and packaged in the GPAC abi-16.24 release. Additional context is available in GitHub Issue #3830 and the VulDB CVE-2026-92473 entry.

Workarounds

Disable BIFS and LASeR processing in GPAC build configurations where the features are not required
Apply operating system sandboxing such as seccomp, AppArmor, or SELinux profiles to GPAC processes
Reject scene graph files from untrusted origins at the ingest layer until patching is complete

bash

# Verify installed GPAC version and upgrade from source
MP4Box -version

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.24
./configure && make && sudo make install