CVE-2026-90577 in GPAC
Summary
by MITRE • 09/13/2026
A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version abi-16.23 addresses this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. The affected component should be upgraded.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in GPAC, specifically within the MP4Box utility up to commit f1219cde, represents a critical security flaw located in the scenegraph processing subsystem. This issue resides in the gf_node_get_field function found in the source file scenegraph/base_scenegraph.c. The core technical defect is classified as a heap-based buffer overflow, which occurs when the application attempts to write data beyond the boundaries of an allocated memory region on the heap. Heap overflows are particularly dangerous because they can corrupt adjacent memory structures, leading to unpredictable program behavior, crashes, or potentially arbitrary code execution if the attacker can control the overwritten data and manipulate function pointers or object headers within the same allocation pool.
The operational impact of this vulnerability is significant due to its potential for exploitation by local users. Since the attack vector requires local access, it typically affects scenarios where untrusted input can be introduced into MP4Box through file processing operations performed on a user's machine. An attacker with local privileges could craft a malicious media file or scenegraph element that triggers this overflow when processed by GPAC. Given that an exploit for this vulnerability is already public and actively available, the risk level is elevated as threat actors may leverage existing proof-of-concept code to compromise systems running affected versions of MP4Box without needing to develop new exploitation techniques from scratch.
From a classification perspective, this flaw aligns with CWE-122, which denotes heap-based buffer overflow, indicating insufficient bounds checking on memory allocation and copy operations within the gf_node_get_field routine. In terms of offensive security frameworks such as MITRE ATT&CK, this vulnerability facilitates initial access or privilege escalation depending on the context in which MP4Box is executed, particularly if it processes files from untrusted sources like email attachments or downloaded content. The lack of proper validation for field indices or data lengths allows an attacker to exceed allocated buffer limits, leading to memory corruption that can be exploited to execute malicious payloads.
To mitigate this risk, immediate action is required by upgrading GPAC and MP4Box to version abi-16.23 or later, which incorporates the necessary fixes in the scenegraph handling logic. The specific patch addressing this issue is identified as commit 49dee5cad329cfed310c1682703df7daa47df31a. Organizations and individual users should verify their current version of GPAC and apply the upgrade promptly to close the attack surface. Additionally, implementing strict input validation policies for any custom integrations using MP4Box can provide defense-in-depth measures against similar memory corruption vulnerabilities in related components.