CVE-2026-108539

Name of the Vulnerable Software and Affected Versions GPAC versions prior to 26.07.1

Description A use after free issue exists in the MP4Box component within the gf fq pop() function of the filter core/filter queue.c file. This flaw allows a remote attacker to trigger the condition through specific manipulation. Use after free is a memory corruption flaw where an application continues to use a pointer after it has been freed, which can lead to crashes or arbitrary code execution.

Recommendations Update GPAC to a version newer than 26.07.0. As a temporary mitigation, restrict the use of the gf fq pop() function within the MP4Box component.