CVE-2026-90613
Received Received - Intake

Heap-based Buffer Overflow in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90613
EUVD
EUVD-2026-77168

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac gpac to f1219cde (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90613 is a reachable assertion failure in GPAC's MP4Box tool when processing malformed MP4 files. The issue occurs in the stbl_GetSampleInfos function of isomedia/stbl_read.c. When MP4Box is used with the -add argument on a crafted file, a corrupted SampleToChunk box violates an internal invariant, triggering an assertion that causes the program to abort. The vulnerability was fixed by replacing the assertion with proper error handling to reject malformed sample table structures.

Detection Guidance

To detect this vulnerability, monitor for crashes or assertion failures when processing MP4 files with GPAC's MP4Box tool. Use the command `MP4Box -add <malformed_file> -new /tmp/out.mp4` on suspicious files to trigger the assertion error. Check logs for crashes in GPAC processes.

Impact Analysis

This vulnerability can cause a denial of service by crashing MP4Box when processing a specially crafted MP4 file. Since the attack must be initiated locally, it requires an attacker to have access to the system where MP4Box is running. The exploit has been publicly released, increasing the risk of misuse.

Compliance Impact

This vulnerability causes a denial of service by crashing GPAC's MP4Box tool when processing malformed MP4 files. While it does not directly expose or leak data, compliance with GDPR or HIPAA could be indirectly impacted if the denial of service disrupts systems handling protected or sensitive data processing. However, no direct evidence in the provided context links this vulnerability to specific compliance violations.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch 49dee5cad329cfed310c1682703df7daa47df31a. Avoid processing untrusted MP4 files with MP4Box. Disable or restrict access to MP4Box in environments where it is not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90613. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart