CVE-2026-90687
Received Received - Intake

Use After Free in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90687
EUVD
EUVD-2026-77206

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90687 is a use-after-free vulnerability in GPAC's MP4Box affecting the gf_node_changed_internal function. It occurs during teardown of a malformed scene graph where a node is freed before its parent is notified, leading to memory corruption or crashes when the parent's state is accessed later. The issue is triggered by processing crafted scene files with MP4Box's -add command.

Detection Guidance

To detect CVE-2026-90687, monitor MP4Box crashes or memory corruption when processing media files. Use AddressSanitizer (ASan) with MP4Box to detect heap-use-after-free errors. Run: ASAN_OPTIONS=detect_leaks=1 MP4Box -add input.mp4 output.mp4. If a crash occurs, check logs for heap-use-after-free messages.

Impact Analysis

This vulnerability could allow remote attackers to cause crashes or memory corruption in GPAC's MP4Box by processing specially crafted files. Users may experience application instability, data corruption, or potential arbitrary code execution if exploited. Systems processing untrusted media files are particularly at risk.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Avoid processing untrusted media files with MP4Box until patched. Disable MP4Box network-facing features if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90687. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart