A security vulnerability has been detected in GPAC up to 26.07.0. (CVE-2026-108538)

CVE-2026-108538 describes a use-after-free vulnerability in the GPAC multimedia framework, specifically in the gf_mx_v function of the utils/os_thread.c file within the MP4Box component. This vulnerability allows remote attackers to manipulate memory leading to use-after-free conditions. The vulnerability has been publicly disclosed, and while an exploit exists, there is no indication of active exploitation in the wild. The vendor was contacted but did not provide any response or patch information.

Successful exploitation of this vulnerability could allow an attacker with low privileges to cause a use-after-free condition remotely, potentially leading to information disclosure, integrity compromise, or denial of service. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability, each at a low level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are provided, users should monitor official GPAC channels for updates. Until a fix is available, consider restricting network exposure of vulnerable components if feasible.