CVE-2026-90612
Received Received - Intake

Reachable Assertion in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was identified in GPAC up to f1219cde. Affected is the function gf_sm_dump_command_list of the file scene_manager/scene_dump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90612
EUVD
EUVD-2026-77167

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23
gpac gpac to f1219cde (exc)
gpac gpac abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90612 is a reachable assertion vulnerability in GPAC's MP4Box tool. It occurs when processing crafted MP4 files with the -bt flag, causing an assertion failure in the function gf_sm_dump_command_list. The issue arises from a corrupted scene dump state during BIFS scene parsing of malformed ISO data, leading to an immediate program abort and denial of service.

Detection Guidance

To detect this vulnerability, monitor for assertion failures in GPAC's MP4Box when processing MP4 files with the -bt flag. Check for crashes or core dumps in scene_manager/scene_dump.c, specifically around line 2911 where the assertion !sdump->current_com_list fails. Use commands like 'mp4box -bt input.mp4' on suspicious files to trigger the issue.

Impact Analysis

This vulnerability can cause a denial of service by crashing MP4Box when processing malicious MP4 files. Since the exploit is publicly available, attackers could use it to disrupt applications relying on GPAC for media processing. The impact is local as the attack requires execution on the affected system.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a local denial-of-service issue in GPAC's MP4Box tool. It causes program aborts but does not involve unauthorized data access, processing, or disclosure that would violate these standards.

Mitigation Strategies

Immediately upgrade GPAC to version abi-16.23 or later using the patch identifier afca1f1181668d85941d51ed1adf647807d5d975. Avoid processing untrusted MP4 files with the -bt flag until patched. Remove or restrict access to the vulnerable MP4Box component if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90612. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart