CVE-2026-90611
Received Received - Intake

Heap Assertion Failure in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmt_parse_element of the file scene_manager/loader_xmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 will fix this issue. This patch is called afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90611
EUVD
EUVD-2026-77166

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23
gpac gpac to f1219cde (exc)
gpac gpac abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90611 is a reachable assertion failure in GPAC's MP4Box tool. It occurs when processing crafted XMT files in the xmt_parse_element function of scene_manager/loader_xmt.c. The vulnerability triggers an assertion failure at line 2104, causing the program to abort immediately in debug builds.

Detection Guidance

To detect this vulnerability, check if your system is running GPAC MP4Box with the affected version (commit f1219cde). Run MP4Box -version to verify the version. If assertions are enabled, test with a crafted XMT file using MP4Box -add poc_30_add to see if it triggers an assertion failure.

  • Run: MP4Box -version to check the GPAC version.
  • Run: MP4Box -add <crafted_xmt_file> to test for assertion failure if assertions are enabled.
Impact Analysis

This vulnerability can lead to a denial of service (DoS) condition. Attackers can exploit it by providing maliciously crafted XMT files to MP4Box, causing the program to crash. The impact is limited to local execution and affects debug builds of GPAC.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a local denial-of-service issue in GPAC's MP4Box tool. It causes program termination during processing of crafted files but does not involve unauthorized data access, processing, or disclosure that would violate these standards.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch afca1f1181668d85941d51ed1adf647807d5d975. If upgrading is not immediately possible, avoid processing untrusted XMT files with MP4Box or disable assertions in debug builds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90611. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart