Submit #914952: GPAC GPAC MP4Box v26.07.0 Heap Use-After-Free

Affected Versions
GPAC master commit f1219cde dated 2026-07-25: reproduced with AddressSanitizer.
GPAC v26.07.0: the release source deactivates a node after the child-replacement call that can release it; its packaged binary was not rerun as part of this material.
The issue was closed by commit 49dee5cad329cfed310c1682703df7daa47df31a. No later formal release is identified as fixed without separate verification.

Classification
Attack type: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Exploit availability: Public proof-of-concept
Proven impact: Application crash and loss of availability
Suggested severity: Medium
CVSS 3.1 score: 5.5
CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Technical Description
GPAC MP4Box contains a heap use-after-free in LASeR scene command handling during -nstatx processing of a crafted MP4. In the vulnerable GF_SG_LSR_DELETE path, gf_sg_command_apply first calls gf_node_replace_child to remove a target node and then calls gf_node_deactivate on the saved pointer. Child replacement can unregister and free the target, leaving gf_node_deactivate_ex to dereference released memory.

AddressSanitizer reports an eight-byte invalid read at gf_node_deactivate_ex. Its free stack reaches gf_node_replace_child on the immediately preceding line of gf_sg_command_apply, providing a direct lifecycle and ordering relationship.

The demonstrated result is a process abort and denial of service. Code execution, information disclosure, and data modification have not been demonstrated.

Proof of Concept
PoC archive: poc_20_nstatx.zip
PoC URL: https://github.com/user-attachments/files/30400423/poc_20_nstatx.zip

Command:

MP4Box -nstatx poc_20_nstatx
Observed sanitizer result:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8
#0 gf_node_deactivate_ex scenegraph/base_scenegraph.c:2219
#1 gf_node_deactivate scenegraph/base_scenegraph.c:2248
#2 gf_sg_command_apply scenegraph/commands.c:677
...
Free path: gf_node_free -> gf_svg_node_del -> gf_node_del
-> gf_node_unregister -> gf_node_replace_child
-> gf_sg_command_apply scenegraph/commands.c:676
SUMMARY: AddressSanitizer: heap-use-after-free in gf_node_deactivate_ex
ABORTING
Root Cause
The scene command implementation uses the target node pointer after a replacement/removal operation that may release the final reference to that node. The deactivation call is ordered after the lifetime-ending operation.

Countermeasure
Upgrade to a GPAC build containing commit 49dee5cad329cfed310c1682703df7daa47df31a:

https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a

The relevant patch deactivates the node before calling gf_node_replace_child, including corresponding ordering changes in related replacement handling. The commit closes several fuzz issues, so this report's PoC should be used for issue-specific regression testing.

Until an upgrade is available, avoid -nstatx processing of untrusted MP4 files, execute MP4Box in a low-privilege sandbox, and quarantine inputs that crash a worker.

Similarity Note
The public report references GPAC issues 3811 and 3738 as similar. This report has a distinct PoC (poc_20_nstatx), a top frame in gf_node_deactivate_ex, and a specific replace-then-deactivate ordering in gf_sg_command_apply. VulDB may still merge related findings according to its duplicate policy.

• Source: ⚠️ https://github.com/gpac/gpac/issues/3813
• User: fczhang (UID 97720)
• Submission: 08/04/2026 15:58 (1 month ago)
• Moderation: 09/13/2026 21:17 (1 month later)
• Status: Accepted
• VulDB entry: 403329 [GPAC 26.07.0 MP4Box base_scenegraph.c gf_node_deactivate_ex use after free]
• Points: 20