Description
GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gpac | gpac | ≤ 26.07.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 22.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gpac | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 16.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gpac | No fix yet | — |
References
- GitHub Issue #4032 issue-tracking
- https://github.com/gpac/gpac product
- https://github.com/gpac/gpac/commit/1359c4da9329cedceeb8fcfeab6d97e0927236e1 patch
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/224/224_gf_sg_command_apply_scenegraph_commands_c_346.xmt exploit
- https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/commands.c#L321 technical-description
- VulnCheck Advisory: GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace third-party-advisory