CVE-2026-90826

Deferred Deferred - Pending Action

Out-of-Bounds Read in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description

A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-14

Last Modified

2026-09-14

Generated

2026-10-05

AI Q&A

2026-09-15

EPSS Evaluated

2026-10-03

NVD

CVE-2026-90826

EUVD

EUVD-2026-78162

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	mp4box	to abi-16.23 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.
CWE-119	The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in GPAC 26.07.0, specifically in the function gf_node_del within the file scenegraph/base_scenegraph.c of the MP4Box component. It allows local attackers to read beyond allocated memory due to improper handling in the function.

Detection Guidance

This vulnerability is specific to GPAC 26.07.0 and involves a local out-of-bounds read in the MP4Box component. Detection requires checking the installed version of GPAC and verifying if the vulnerable function gf_node_del is present in the affected file.

Impact Analysis

The vulnerability may allow local attackers to read sensitive memory data, potentially leading to information disclosure. However, the impact is limited as the attack requires local execution and does not directly enable code execution or privilege escalation.

Compliance Impact

The provided CVE data does not specify direct impacts on compliance with standards like GDPR or HIPAA. The vulnerability involves an out-of-bounds read in GPAC 26.07.0, which may lead to local execution issues but lacks details on data exposure or privacy implications required for compliance assessments.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch named afca1f1181668d85941d51ed1adf647807d5d975 to resolve the issue. Since the attack is restricted to local execution, ensure the vulnerable component is not exposed to untrusted users or networks.

Hi! I’m here to help you understand CVE-2026-90826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70