CVE-2026-90683
Received Received - Intake

Assertion Failure in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to address this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component. This is not a duplicate of CVE-2021-46237 or CVE-2021-46234.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90683
EUVD
EUVD-2026-77199

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23
gpac gpac to f1219cde|start_including=abi-16.23 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90683 is a reachable assertion failure vulnerability in GPAC's MP4Box tool. It occurs in the gf_node_unregister function of base_scenegraph.c when processing a maliciously crafted MP4 file. The issue involves an assertion check on pNode->sgprivate->num_instances that fails when the node's instance count is manipulated to zero, causing MP4Box to abort abruptly.

Detection Guidance

Detecting this vulnerability requires checking for GPAC MP4Box versions prior to abi-16.23. Use commands like 'mp4box -version' to check the installed version. If the version is below abi-16.23, the system is vulnerable. Monitor for crashes when processing MP4 files with the '-nstatx' argument.

Impact Analysis

This vulnerability can lead to a denial of service when an attacker provides a specially designed MP4 file. It causes MP4Box to crash abruptly during processing, potentially disrupting media processing tasks that rely on GPAC.

Compliance Impact

This vulnerability causes a denial of service by crashing MP4Box when processing maliciously crafted MP4 files. While it does not directly expose data, compliance risks may arise if the tool is used in systems handling sensitive data under GDPR or HIPAA, as crashes could disrupt processing workflows or lead to unavailability of services.

Mitigation Strategies

Upgrade GPAC MP4Box to version abi-16.23 or later. Apply the patch 49dee5cad329cfed310c1682703df7daa47df31a. Avoid processing untrusted MP4 files with the '-nstatx' argument until patched. Disable assertions if necessary for temporary mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90683. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart