CVE-2026-90793 in GPAC
Summary
by MITRE • 09/14/2026
A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in GPAC, specifically affecting versions up to commit f1219cde, resides within the gf_node_get_name function located in the scenegraph/base_scenegraph.c file of the MP4Box component. This flaw constitutes a use-after-free condition, a critical memory safety error where program execution continues after memory has been deallocated or freed. In the context of multimedia processing frameworks like GPAC, such vulnerabilities often arise when object references are not properly managed during scene graph traversal or node manipulation operations. The gf_node_get_name function is responsible for retrieving the identifier associated with a specific scenegraph node. If this function accesses memory that has already been released by another part of the application logic, it results in undefined behavior, which can lead to crashes, data corruption, or potentially arbitrary code execution depending on how the freed memory is subsequently utilized and what data resides at that memory address.
From an operational perspective, the impact of this vulnerability is severe due to its remote exploitability. Attackers who can deliver maliciously crafted media files or network streams containing specific scenegraph structures may trigger the use-after-free condition when MP4Box processes them. Since GPAC and MP4Box are widely used for encoding, decoding, and manipulating multimedia content, including MPEG-4 systems, an attacker could potentially leverage this flaw to execute arbitrary commands on a victim's system if they can trick a user or service into processing a malicious file. The fact that the exploit has been disclosed publicly significantly increases the risk landscape, as it lowers the barrier for entry for less sophisticated attackers who may utilize existing proof-of-concept code rather than developing their own exploits from scratch. This public disclosure necessitates immediate attention to mitigate potential widespread compromise of systems relying on affected versions of GPAC.
The technical classification of this vulnerability aligns with Common Weakness Enumeration (CWE) ID 416, which defines use-after-free errors. These weaknesses are particularly dangerous because they can often be chained with other vulnerabilities or exploited through heap spraying techniques to achieve code execution. In terms of the MITRE ATT&CK framework, this type of memory corruption vulnerability is typically associated with initial exploitation vectors that may lead to privilege escalation or remote code execution, falling under tactics such as Execution and Defense Evasion if used to bypass security controls via crash-based fuzzing or heap manipulation techniques. The specific function involved suggests a flaw in the lifecycle management of scenegraph nodes, where pointers are not invalidated after memory release, allowing stale references to be dereferenced later during node name retrieval operations.
To address this critical issue, it is strongly recommended that organizations and developers upgrade GPAC immediately to version abi-16.23 or any subsequent patched release. The specific patch addressing this vulnerability is identified by the commit hash 9eb40df4448b88d6a6ce3454657c06f47eff0b24, which likely implements proper pointer nullification and reference counting adjustments to prevent access to freed memory. For environments where immediate upgrading is not feasible due to dependency constraints or testing requirements, temporary mitigations should include implementing strict input validation for media files processed by MP4Box, restricting the execution of untrusted multimedia content in sandboxed environments, and deploying intrusion detection systems capable of identifying anomalous behavior patterns associated with heap exploitation attempts. Regular security audits and static analysis tools configured to detect use-after-free conditions can also help identify similar issues in custom integrations or forks of the GPAC codebase before they are exploited in production environments.