CVE-2026-90686 in GPAC
Summary
by MITRE • 09/14/2026
A vulnerability was found in GPAC up to f1219cde. This affects the function gf_bt_report of the file scene_manager/loader_bt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The vulnerability in question resides within GPAC, specifically affecting the MP4Box utility up through commit f1219cde. This security flaw is located in the gf_bt_report function found in the scene_manager/loader_bt.c source file. The core technical issue involves memory corruption, which typically arises when a program writes data beyond the boundaries of allocated memory buffers or performs operations on uninitialized memory pointers. In this specific context, the manipulation likely stems from improper handling of binary tree structures used for managing media scenes, where input validation may be insufficient to prevent out-of-bounds writes or use-after-free conditions during report generation processes. Such memory corruption vulnerabilities are critical because they can lead to arbitrary code execution if an attacker can control the data being written into corrupted memory regions.
From a threat modeling perspective, this vulnerability is classified as remotely exploitable, meaning that an adversary does not need physical access or local authentication to trigger the flaw. The attack vector involves sending specially crafted MP4 files or media streams to the vulnerable GPAC instance via network services such as HTTP streaming or file upload mechanisms. Once triggered, the memory corruption can destabilize the application process entirely, leading to denial of service through crashes. More severely, if the execution environment allows for heap spraying or specific gadget chaining techniques, it could result in remote code execution with the privileges of the user running MP4Box. The fact that a public exploit exists significantly elevates the risk profile, as automated scanning tools and malicious actors can readily leverage this known weakness without needing to develop custom exploitation logic from scratch.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-120 Buffer Overflow or CWE-787 Out-of-bounds Write, depending on the precise nature of the memory corruption observed during analysis. It also maps to MITRE ATT&CK techniques related to Initial Access via Spearphishing Attachment if delivered through malicious media files, and potentially Execution via Command and Scripting Interpreter if code execution is achieved. The presence of a public exploit places this vulnerability in a high-severity category within most vulnerability scoring systems due to the low barrier to entry for attackers. Organizations relying on GPAC for media processing pipelines are particularly exposed because MP4Box is often used as part of automated transcoding or validation workflows that may process untrusted content from external sources.
To mitigate this risk, immediate action is required to update the affected component to version abi-16.23 or later. The specific patch addressing this issue is identified by commit hash afca1f1181668d85941d51ed1adf647807d5d975, which likely introduces stricter bounds checking and input validation within the gf_bt_report function. Until the upgrade is implemented, organizations should consider implementing network-level controls such as deep packet inspection or file type filtering to block suspicious MP4 payloads from reaching vulnerable instances of GPAC. Additionally, running MP4Box in a sandboxed environment with restricted privileges can limit the impact if an exploit attempt succeeds by preventing escalation to system-level access. Regular monitoring for new CVEs related to media processing libraries is also recommended given the frequent updates required in this domain to address emerging exploitation techniques.