CVE-2026-90684
Received Received - Intake

Heap-based Buffer Overflow in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version abi-16.23 addresses this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90684
EUVD
EUVD-2026-77203

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (exc)
gpac gpac to abi-16.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90684 is an assertion failure vulnerability in GPAC's MP4Box tool. It occurs when processing a maliciously crafted MP4 file using the -info command. The function gf_node_get_field_count in scenegraph/base_scenegraph.c fails to validate a NULL node pointer before accessing it, causing an assertion failure and program crash.

Detection Guidance

To detect this vulnerability, inspect MP4 files for malformed scene graphs using GPAC's MP4Box tool. Run the command 'MP4Box -info <file.mp4>' on suspicious files. If the system crashes with an assertion failure error in gf_node_get_field_count, the vulnerability may be present.

Impact Analysis

This vulnerability can lead to a denial of service when processing malicious MP4 files. It may cause MP4Box to crash, potentially disrupting media processing workflows. The exploit requires local access and can be triggered by a specially crafted file.

Compliance Impact

This vulnerability is a denial-of-service issue caused by a reachable assertion failure in GPAC's MP4Box tool when processing crafted MP4 files. It does not directly involve data exposure or unauthorized access, so it is unlikely to directly violate GDPR or HIPAA compliance on its own. However, if the tool is used in systems handling sensitive data, crashes could disrupt operations, potentially leading to service unavailability or data processing delays that may indirectly impact compliance.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or later using the patch 49dee5cad329cfed310c1682703df7daa47df31a. Avoid processing untrusted MP4 files with MP4Box, especially using the -info argument. Remove or quarantine any files that trigger the assertion failure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90684. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart