Use-After-Free Vulnerability in GPAC Compositor

A use-after-free vulnerability has been identified in the GPAC multimedia framework, specifically affecting the 'gf_mo_get_od_id' function within 'compositor/media_object.c'. The flaw exists in all versions up to f1219cde. This vulnerability allows for remote exploitation when a user processes a specifically crafted malicious media file. Successful exploitation leads to memory corruption, which may result in application crashes or the potential for arbitrary code execution. As public exploit code for this vulnerability is currently available, it poses a significant risk to systems processing untrusted media content. The issue is addressed in the GPAC project by upgrading to version 'abi-16.24' or applying the patch identified by commit 'e34f4ba349d55cd1849f0bcf4cf46552732e2db7'. Organizations using GPAC as a library or standalone tool should prioritize patching.

Impact

The vulnerability is rated with a CVSS v3.1 base score of 7.3, reflecting its high impact and remote exploitability. Successful exploitation allows for unauthorized memory access, potentially leading to service disruption through crashes or exploitation as an entry point for remote code execution. This impacts any environment utilizing GPAC to parse or render multimedia content, such as media players, streaming servers, or content transcoding pipelines.

Recommendation

• Upgrade all instances of GPAC to version 'abi-16.24' or later.
• If upgrading is not immediately feasible, apply patch 'e34f4ba349d55cd1849f0bcf4cf46552732e2db7' to the 'compositor/media_object.c' source file.
• Monitor file processing services that ingest external media for unexpected process crashes or anomalous memory usage.