CVE-2026-90686
Received Received - Intake

Memory Corruption in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was found in GPAC up to f1219cde. This affects the function gf_bt_report of the file scene_manager/loader_bt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90686
EUVD
EUVD-2026-77205

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90686 is a medium-severity vulnerability in GPAC, a multimedia framework. It affects the MP4Box tool due to an invalid read in the gf_bt_report function when parsing malformed BT/BIFS commands. The issue occurs when an unknown command error triggers a format string with a %s placeholder but no required string argument, causing vsnprintf to misinterpret data and crash MP4Box via a segmentation fault.

Detection Guidance

To detect this vulnerability, monitor for crashes in MP4Box when processing BT/BIFS files. Use AddressSanitizer to detect invalid reads in gf_bt_report. Check for segmentation faults during scene parsing with malformed input files.

Impact Analysis

This vulnerability can cause MP4Box to crash when processing a specially crafted malicious BT/BIFS scene file, leading to a denial of service. Applications or automated pipelines that handle untrusted input using GPAC's scene parser are also at risk of crashes. Exploitation requires crafting a specific input file to trigger the error.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch commit afca1f1181668d85941d51ed1adf647807d5d975. Avoid processing untrusted BT/BIFS files in MP4Box until patched. Disable MP4Box usage for untrusted input if immediate upgrade is not possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart