CVE-2026-90685
Received Received - Intake

Reachable Assertion in GPAC MP4Box via lsr_dec.c

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsr_exec_command_list of the file laser/lsr_dec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 can resolve this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90685
EUVD
EUVD-2026-77204

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90685 is a vulnerability in GPAC's MP4Box tool where a reachable assertion failure occurs in the lsr_exec_command_list function of the laser/lsr_dec.c file. Processing a malformed MP4 file with the -bt argument triggers an uncleaned codec bitstream state, causing the assertion assert(!codec->bs) to fail. This leads to an immediate program abort and denial of service.

Detection Guidance

This vulnerability can be detected by analyzing MP4 files processed by GPAC's MP4Box tool. Use the `-bt` argument to dump BIFS text and check for assertion failures during processing. Monitor logs for crashes when handling malformed MP4 files with specific LASeR event types (62, 50, 33).

Commands to test: `MP4Box -bt input.mp4` to trigger potential assertion failures. Ensure GPAC version is below the patched release.

Impact Analysis

This vulnerability allows local attackers to cause a denial of service by crashing MP4Box when processing specially crafted MP4 files. Since it requires local access, the risk is limited to users who run MP4Box on untrusted files. The impact is program termination, which may disrupt media processing workflows.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or later. Apply the patch identified by commit afca1f1181668d85941d51ed1adf647807d5d975 to replace assertions with proper error handling in the lsr_exec_command_list function.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90685. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart