CVE-2026-90793
Deferred Deferred - Pending Action

Use After Free in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90793
EUVD
EUVD-2026-77594

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23
gpac gpac to f1219cde (exc)
gpac gpac abi-16.23
gpac gpac to f1219cde (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90793 is a heap-use-after-free vulnerability in GPAC's MP4Box tool. It occurs when processing malformed Binary Text (BT) scene files. The issue involves the DEF/USE resolution process where a node is freed but later accessed via the gf_node_get_name function, leading to a memory corruption error.

Detection Guidance

To detect this vulnerability, monitor MP4Box processes for crashes or memory errors when processing BT scene files. Use AddressSanitizer or similar tools to detect heap-use-after-free errors in gf_node_get_name. Check GPAC logs for AddressSanitizer output indicating memory access violations at scenegraph/base_scenegraph.c:1340.

Impact Analysis

This vulnerability can be exploited by processing a crafted BT scene file with MP4Box using commands like -add or -info. It may cause a denial-of-service condition or, in some cases, more severe memory corruption. Attackers can remotely trigger this issue with malicious input files.

Compliance Impact

This vulnerability, a heap-use-after-free in GPAC's MP4Box, primarily impacts system stability and integrity by causing crashes or memory corruption when processing malformed files. It does not directly expose or leak sensitive data, which is a key concern for GDPR or HIPAA compliance. However, if exploited to cause denial-of-service, it could disrupt services handling protected health or personal data, indirectly affecting compliance by failing availability requirements.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Avoid processing untrusted BT scene files with MP4Box. Disable MP4Box usage for DEF/USE resolution until patched. Monitor for crashes or memory errors during file processing.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90793. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart