提出 #914950: GPAC GPAC MP4Box v26.07.0 Heap Use-After-Free

Affected Versions
GPAC master commit f1219cde dated 2026-07-25: reproduced with AddressSanitizer.
GPAC v26.07.0: the release source lacks the proto default-node cleanup introduced by the fix; its packaged binary was not rerun as part of this material.
The issue was closed by commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24. No later formal release is identified as fixed without separate verification.

Classification
Attack type: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Exploit availability: Public proof-of-concept
Proven impact: Application crash and loss of availability
Suggested severity: Medium
CVSS 3.1 score: 5.5
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Technical Description
GPAC MP4Box contains a heap use-after-free in scene graph teardown after importing a malformed scene with -add. A proto field can retain a reference to a node that has already been released during gf_sg_reset. Later proto destruction reaches gf_node_unregister through gf_sg_proto_del and gf_node_unregister_children, where the stale reference is read.

AddressSanitizer reports an eight-byte read from a previously freed 32-byte allocation. The object was created by Script_Create, released through the scene graph node deletion path, and subsequently accessed while proto objects were being destroyed.

The demonstrated result is a deterministic process abort. Code execution, data modification, and information disclosure have not been demonstrated.

Proof of Concept
PoC archive: poc_09_add.zip
PoC URL: https://github.com/user-attachments/files/30399108/poc_09_add.zip

Command:

MP4Box -add poc_09_add -new /tmp/out.mp4
Observed sanitizer result:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8
#0 gf_node_unregister scenegraph/base_scenegraph.c:721
#1 gf_node_unregister_children scenegraph/base_scenegraph.c:1416
#2 gf_sg_proto_del scenegraph/vrml_proto.c:133
#3 gf_sg_reset scenegraph/base_scenegraph.c:535
...
SUMMARY: AddressSanitizer: heap-use-after-free in gf_node_unregister
ABORTING
Root Cause
The vulnerable teardown path does not remove all default SFNode/MFNode references owned by proto fields before recursively destroying graph and proto data. These references can outlive their target nodes and become dangling pointers.

Countermeasure
Upgrade to a GPAC build containing commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24:

https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24

The relevant remediation adds drop_proto_default_field_nodes, unregisters default node references, and clears the associated pointers before nested proto cleanup. The commit closes several fuzz findings, so regression testing with this specific PoC is recommended.

Where immediate upgrade is not possible, backport the fix, reject untrusted scene inputs, and run MP4Box in a constrained low-privilege environment.

• ソース: ⚠️ https://github.com/gpac/gpac/issues/3805
• ユーザー: fczhang (UID 97720)
• 送信: 2026年08月04日 15:56 (1 月 ago)
• モデレーション: 2026年09月13日 21:16 (1 month later)
• ステータス: 承諾済み
• VulDBエントリ: 403327 [GPAC 26.07.0 MP4Box base_scenegraph.c gf_node_unregister メモリ破損]
• ポイント: 20