---
id: CVE-2026-108539
title: A vulnerability was detected in GPAC up to 26.07.0
summary: >-
  A vulnerability was detected in GPAC up to 26.07.0. This affects the function
  gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box.
  Performing a manipulation results in use after free. The attack may be
  initiated remo…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L'
cwe:
  - CWE-119
  - CWE-416
published: '2026-10-11'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:17:20.140'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108539'
references:
  - url: 'https://github.com/user-attachments/files/31288202/PoC.zip'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-108539'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/941995'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416194'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416194/cti'
    label: cna@vuldb.com
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00297
epssPercentile: 0.22186
ingestedAt: '2026-10-11T05:42:11.233Z'
product: GPAC
affected:
  - GPAC 26.07
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T19:57:24.338623Z'
---

## Overview

A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.