CVE-2026-90794
Deferred Deferred - Pending Action

Use After Free in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90794
EUVD
EUVD-2026-77575

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac gpac to abi-16.23 (inc)
gpac gpac abi-16.23
gpac gpac to f1219cde (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in GPAC up to version f1219cde. It exists in the function gf_sg_script_load within the file scenegraph/vrml_tools.c of the MP4Box component. A use-after-free occurs when a program continues to use memory after it has been freed, potentially leading to crashes or arbitrary code execution. The attack can be initiated remotely, and a public exploit is available.

Detection Guidance

To detect this vulnerability, monitor for crashes in GPAC's MP4Box when processing XMT files. Use AddressSanitizer with MP4Box to detect heap-use-after-free errors. Example command: MP4Box -add poc_02_add.zip -out test.mp4 with ASAN enabled.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by exploiting the use-after-free condition. If successfully exploited, it may lead to system crashes, data corruption, or unauthorized access to sensitive information. The impact depends on the privileges of the user running the affected application.

Compliance Impact

This vulnerability, a heap-use-after-free in GPAC's MP4Box, could potentially lead to unauthorized memory access or crashes when processing malformed files. While not directly tied to GDPR or HIPAA, such vulnerabilities may impact compliance by exposing systems to data breaches or integrity issues if exploited. Organizations handling sensitive data under these regulations should assess the risk of such memory corruption flaws in their media processing pipelines.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch named 9eb40df4448b88d6a6ce3454657c06f47eff0b24 to fix the use after free vulnerability in the MP4Box component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90794. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart