PT-2026-110006

CVE-2026-108538

Published

2026-10-11

Updated

2026-10-15

Description by

CVSS 2.0

6.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GPAC versions prior to 26.07.0

Description A use after free issue exists in the MP4Box component within the gf mx v() function of the utils/os thread.c file. This flaw allows a remote attacker to trigger the condition through specific manipulation.

Recommendations Update GPAC to a version later than 26.07.0. As a temporary mitigation, restrict the use of the gf mx v() function within the MP4Box component.

Exploitability

Exploit

Fix

Impacts

Researchers

Ziiiro

Vendors

Affected products

Weakness enumeration

CWE-416: Use After Free

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer

Related identifiers