Description
GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| gpac | gpac | ≤ 26.07.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 22.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 20.04 LTS | gpac | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 16.04 LTS | gpac | No fix yet | — |
| Ubuntu Pro 14.04 LTS | gpac | No fix yet | — |
References
- https://github.com/gpac/gpac/issues/4031 issue-tracking
- https://github.com/gpac/gpac/commit/a2e5c62c213b5329a4572fe8e7c333e1ca26d028 patch
- https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/vrml_proto.c#L103-L111 technical-description
- https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/base_scenegraph.c#L537-L542 technical-description
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/223/223_gf_sg_proto_del_scenegraph_vrml_proto_c.xmt exploit
- https://github.com/gpac/gpac product
- VulnCheck Advisory: GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown third-party-advisory