Description
GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gpac | gpac | ≤ 26.07.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 22.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gpac | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 16.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gpac | No fix yet | — |
References
- https://github.com/gpac/gpac/issues/4029 issue-tracking
- https://github.com/gpac/gpac/commit/bc416b997622e43de65afab3bae9b7d05d72f2b0 patch
- https://github.com/gpac/gpac/blob/v26.07.0/src/compositor/mpeg4_form.c#L620-L621 technical-description
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/221/221_ab_apply_compositor_mpeg4_form_c_627.xmt exploit
- https://github.com/gpac/gpac product
- VulnCheck Advisory: GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers third-party-advisory