CVE-2026-90791

Deferred Deferred - Pending Action

Use After Free in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-15

Assigner: VulDB

Description

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-15

Generated

2026-09-15

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90791

EUVD

EUVD-2026-77538

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	mp4box	to f1219cde (inc)
gpac	gpac	abi-16.23
gpac	gpac	to f1219cde (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

CVE-2026-90791 is a use-after-free vulnerability in GPAC's MP4Box tool. It occurs when processing malformed MP4 or XMT scene files, specifically in the gf_node_unregister function. The issue involves improper handling of node references during cleanup, leading to memory corruption when freed memory is accessed again. The flaw affects versions up to commit f1219cde and can be triggered remotely via crafted content.

Detection Guidance

To detect this vulnerability, monitor for crashes in MP4Box when processing malformed XMT or MP4 files. Use AddressSanitizer or Valgrind to identify heap-use-after-free errors. Check GPAC logs for errors in gf_node_unregister or OrderedGroup_Del functions during scene graph cleanup.

Impact Analysis

This vulnerability may allow attackers to crash MP4Box when processing malicious media files, causing denial-of-service conditions. In some environments, it could enable further memory corruption, potentially leading to code execution. Users processing untrusted media files are at higher risk of exploitation.

Compliance Impact

This vulnerability (use-after-free in GPAC MP4Box) could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks or memory corruption when processing malformed media files. Such attacks may disrupt systems handling sensitive personal or health data, violating availability requirements under these regulations.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Avoid processing untrusted XMT or MP4 files with MP4Box. Disable MP4Box in automated pipelines if possible until patched.

Hi! I’m here to help you understand CVE-2026-90791. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70