CVE-2026-90610
Received Received - Intake

Buffer Over-Read in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was found in GPAC up to f1219cde. This affects the function gf_svg_attributes_copy of the file scenegraph/svg_attributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 mitigates this issue. The patch is named afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90610
EUVD
EUVD-2026-77165

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gpac gpac to f1219cde (exc)
gpac gpac abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90610 is a heap-based buffer overflow in GPAC's MP4Box tool. It occurs in the function gf_svg_attributes_copy within scenegraph/svg_attributes.c. The issue arises when processing crafted MP4 files using the -nstatx option, causing a 16-byte out-of-bounds read due to a mismatch between allocated buffer size (4 bytes) and expected read size (20 bytes). This leads to potential information disclosure or denial of service.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable GPAC versions and testing with crafted MP4 files. Use the command 'MP4Box -version' to check the installed GPAC version. If it is below abi-16.23, the system is vulnerable. For detection, attempt to process a crafted MP4 file with the '-nstatx' option to trigger the heap-buffer-overflow. Use tools like AddressSanitizer during compilation to detect memory safety issues.

Example command to check version: MP4Box -version. If the version is older than abi-16.23, the system is affected. Testing with a proof-of-concept file may confirm exploitation attempts.

Impact Analysis

This vulnerability could allow attackers with local access to trigger a buffer over-read, potentially causing application crashes or leaking sensitive memory data. Exploitation requires a specially crafted MP4 file and may lead to denial of service or limited information disclosure.

Compliance Impact

The vulnerability (CVE-2026-90610) involves a heap-based buffer overflow in GPAC MP4Box, which could lead to information disclosure or denial of service. While not explicitly linked to GDPR or HIPAA, such vulnerabilities may impact compliance by exposing sensitive data or disrupting systems handling protected information under these regulations.

Mitigation Strategies

Immediately upgrade GPAC to version abi-16.23 or later. This version includes the patch afca1f1181668d85941d51ed1adf647807d5d975 which fixes the buffer over-read issue in the gf_svg_attributes_copy function.

If upgrading is not immediately possible, restrict access to MP4Box and avoid processing untrusted MP4 files, especially with the '-nstatx' option. Monitor for suspicious activity or crashes when processing media files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90610. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart