CVE-2026-92474: GPAC Use After Free Vulnerability

CVE-2026-92474 Overview

CVE-2026-92474 is a use-after-free vulnerability in GPAC 26.08-DEV, an open-source multimedia framework. The flaw resides in the gf_inline_get_proto_lib function within src/compositor/mpeg4_inline.c, part of the Proto Link Handler component. An attacker with local access can trigger the vulnerability by supplying crafted input that manipulates freed memory references. A public proof-of-concept exploit has been released. The issue is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). Upgrading to GPAC release abi-16.24 mitigates the issue, with the fix committed as e34f4ba349d55cd1849f0bcf4cf46552732e2db7.

Critical Impact
Local exploitation of this use-after-free can corrupt memory during MPEG-4 scene processing, potentially causing process crashes or undefined behavior in applications that link against affected GPAC builds.

Affected Products

GPAC multimedia framework version 26.08-DEV
Applications embedding the GPAC compositor library
Downstream distributions bundling pre-abi-16.24 GPAC builds

Discovery Timeline

2026-09-16 - CVE-2026-92474 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92474

Vulnerability Analysis

The vulnerability is a use-after-free in the gf_inline_get_proto_lib routine, which handles Proto links in MPEG-4 scene graphs. During scene processing, the compositor retains a pointer to a node or proto library that has already been freed. Subsequent dereferences access reclaimed memory, producing undefined behavior. The referenced patch tightens node lookup and command binding in src/laser/lsr_dec.c and adjusts deactivation-flag handling in src/scenegraph/base_scenegraph.c to prevent recursive operations on freed nodes.

Root Cause

The root cause is unsafe reuse of a node pointer after the underlying scene graph node has been freed or deactivated. The pre-patch code assigned com->node = gf_sg_find_node(...) and then invoked gf_node_register without using the sanctioned setter that manages lifetime state. Additionally, the deactivation traversal in base_scenegraph.c did not preserve the prior deactivation state, allowing re-entry into freed structures on cyclic or malformed scene graphs.

Attack Vector

Exploitation requires local access and low privileges. An attacker supplies a crafted MPEG-4 or LASeR asset that is parsed by a GPAC-based tool such as MP4Box or the compositor. Processing the malformed scene triggers the freed pointer path in the Proto Link Handler, corrupting the process state.

// Patch excerpt: src/laser/lsr_dec.c
	for (i=0; i<gf_list_count(codec->unresolved_commands); i++) {
		GF_Command *com = (GF_Command *)gf_list_get(codec->unresolved_commands, i);
		gf_assert(!com->node);
-		com->node = gf_sg_find_node(codec->sg, com->RouteID);
-		if (com->node) {
+		GF_Node *n = gf_sg_find_node(codec->sg, com->RouteID);
+		if (n) {
+			gf_sg_command_set_node(com, n);
			gf_node_register(com->node, NULL);
			com->RouteID = 0;
			gf_list_rem(codec->unresolved_commands, i);

// Patch excerpt: src/scenegraph/base_scenegraph.c
	GF_ChildNodeItem *item;
+	Bool was_deactivated;
	if (depth > 255) return GF_OK;
	if (node->sgprivate->tag<GF_NODE_FIRST_DOM_NODE_TAG) return GF_BAD_PARAM;
-	if (! (node->sgprivate->flags & GF_NODE_IS_DEACTIVATED)) {
+
+	was_deactivated = (node->sgprivate->flags & GF_NODE_IS_DEACTIVATED) ? GF_TRUE : GF_FALSE;
+
+	if (!was_deactivated) {
		node->sgprivate->flags |= GF_NODE_IS_DEACTIVATED;

Source: GitHub Commit e34f4ba

Detection Methods for CVE-2026-92474

Indicators of Compromise

Unexpected crashes or segmentation faults in MP4Box, gpac, or applications that link libgpac when processing MPEG-4 or LASeR content.
Presence of the referenced proof-of-concept archive poc_01.zip staged in temporary or user-writable directories.
Installed GPAC binaries reporting a version prior to release abi-16.24.

Detection Strategies

Inventory endpoints and build systems for GPAC 26.08-DEV or earlier and flag any binary lacking commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7.
Run AddressSanitizer or Valgrind against GPAC parsing pipelines to surface use-after-free conditions in the Proto Link Handler code path.
Correlate abnormal child-process terminations from multimedia converters with recent file drops in user directories.

Monitoring Recommendations

Monitor process telemetry for crashes tied to gf_inline_get_proto_lib or the GPAC compositor on Linux and Windows workstations.
Alert on execution of GPAC command-line utilities against files sourced from untrusted origins or downloaded attachments.
Track package-manager events that install or downgrade GPAC to versions preceding abi-16.24.

How to Mitigate CVE-2026-92474

Immediate Actions Required

Upgrade GPAC to release abi-16.24 or later on every system that ships, builds, or runs the library.
Restrict local execution of GPAC utilities to trusted users and avoid processing untrusted multimedia assets on interactive workstations.
Rebuild and redeploy in-house applications that statically link libgpac after applying the fix.

Patch Information

The fix is available in the GitHub Release abi-16.24 and corresponds to commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Additional context is available in GitHub Issue #3829 and the VulDB CVE-2026-92474 entry.

Workarounds

Disable or avoid using GPAC components that process MPEG-4 Proto or LASeR scene content until the patched build is deployed.
Sandbox GPAC parsing workloads using unprivileged accounts, seccomp filters, or container isolation to constrain the impact of memory corruption.
Remove or quarantine the public proof-of-concept archive from shared storage to reduce accidental execution risk.

bash

# Verify installed GPAC version and upgrade from source
gpac -version
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.24
./configure && make -j"$(nproc)" && sudo make install
gpac -version   # confirm abi-16.24 or later