CVE-2026-90578
Received Received - Intake

Use After Free in GPAC MP4Box

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf_list_count of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version abi-16.23 can resolve this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-14
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90578
EUVD
EUVD-2026-77063

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23
gpac gpac to f1219cde (exc)
gpac gpac abi-16.23
gpac mp4box f1219cde

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90578 is a use-after-free vulnerability in GPAC's MP4Box tool. It occurs in the gf_list_count function when processing a crafted MP4 file with the -nstatx option. The flaw allows a scene command to free a node list while other commands still reference it, causing gf_list_count to access freed memory. This leads to a segmentation fault and process termination, resulting in a denial of service.

Detection Guidance

To detect this vulnerability, monitor for crashes when running MP4Box with the -nstatx option on MP4 files. Check for segmentation faults in utils/list.c at line 664 during gf_list_count execution. Look for invalid pointer dereferences in the Face_Del function.

Impact Analysis

This vulnerability can cause denial of service by crashing MP4Box when processing a specially crafted MP4 file. It requires local execution and user interaction to trigger, as the attacker must run MP4Box with the -nstatx option on a malicious file. The impact is limited to local systems and does not allow arbitrary code execution or data theft.

Compliance Impact

This vulnerability, a use-after-free issue in GPAC's MP4Box, could potentially impact compliance with GDPR or HIPAA if exploited to cause denial of service or data corruption during media processing. However, the provided context does not explicitly link this flaw to specific compliance violations or data protection requirements.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch 49dee5cad329cfed310c1682703df7daa47df31a. Avoid using MP4Box with the -nstatx option on untrusted files until patched. Monitor for crashes in MP4Box processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90578. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart