CVE-2026-108539
Deferred Deferred - Pending Action

Use After Free in GPAC MP4Box via gf_fq_pop

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulDB

Description
A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108539
EUVD
EUVD-2026-96732

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n/a GPAC 26.07

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in GPAC up to version 26.07.0, specifically in the function gf_fq_pop within the file filter_core/filter_queue.c of the MP4Box component. A use-after-free occurs when a program continues to use memory after it has been freed, potentially leading to crashes or arbitrary code execution. The attack can be initiated remotely, and the exploit is now public.

Detection Guidance

Detecting this vulnerability may require monitoring for unusual memory handling or crashes in GPAC's MP4Box component. Check for processes using excessive memory or segfaults. Analyze network traffic for malformed MP4 files or unexpected payloads targeting filter_queue.c. Use tools like strace or gdb to trace MP4Box execution for anomalies.

Impact Analysis

This vulnerability may allow remote attackers to execute arbitrary code, escalate privileges, or cause denial-of-service conditions on systems running vulnerable versions of GPAC. Since the exploit is public, attackers could leverage it to compromise affected systems.

Compliance Impact

The vulnerability involves a use-after-free issue in GPAC's MP4Box component, which could allow remote attackers to execute arbitrary code or cause denial-of-service conditions. This type of vulnerability may lead to unauthorized data access, modification, or deletion, potentially violating GDPR's data integrity and confidentiality requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Immediately update GPAC to the latest version beyond 26.07.0 if available. If no patch exists, disable MP4Box or restrict its use to trusted inputs. Monitor systems for exploitation attempts. Block suspicious network traffic or files. Consider isolating affected systems until mitigation is confirmed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108539. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart