A vulnerability was detected in GPAC up to 26.07.0. (CVE-2026-108539)

CVE-2026-108539 describes a use-after-free vulnerability in the gf_fq_pop function within the filter_core/filter_queue.c file of the MP4Box component in GPAC up to version 26.07.0. This vulnerability allows remote attackers to manipulate the function leading to use-after-free conditions. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts to confidentiality, integrity, and availability. Exploit code is publicly available, but the vendor has not issued any advisory or patch.

Successful exploitation may allow remote attackers to cause use-after-free conditions, potentially leading to limited confidentiality loss, integrity compromise, and availability disruption. The CVSS score of 6.3 reflects a moderate risk. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is publicly available, users should monitor official GPAC channels for updates. Until a fix is released, avoid processing untrusted MP4Box inputs or apply additional sandboxing and memory protection measures where possible.