CVE-2026-90573: GPAC MP4Box Use-After-Free Vulnerability

CVE-2026-90573 Overview

CVE-2026-90573 is a null pointer dereference vulnerability in GPAC, an open-source multimedia framework used for packaging and streaming media content. The flaw resides in the gf_sg_mfurl_del function within scenegraph/vrml_tools.c, part of the MP4Box component. An attacker with local access can trigger the dereference by supplying crafted input that causes the function to operate on a null pointer, leading to a process crash. The issue is tracked under [CWE-404] (Improper Resource Shutdown or Release) and affects GPAC builds up to commit f1219cde. A public exploit reference exists, though the impact is limited to availability of the local process.

Critical Impact
Local attackers can crash MP4Box by triggering a null pointer dereference in gf_sg_mfurl_del, causing denial of service in media processing workflows.

Affected Products

GPAC framework builds up to commit f1219cde
MP4Box multimedia packaging tool (GPAC component)
GPAC releases prior to abi-16.23

Discovery Timeline

2026-09-13 - CVE-2026-90573 published to NVD
2026-09-16 - Last updated in NVD database
Patch commit49dee5cad329cfed310c1682703df7daa47df31a merged into GPAC upstream

Technical Details for CVE-2026-90573

Vulnerability Analysis

The vulnerability affects the gf_sg_mfurl_del function in scenegraph/vrml_tools.c, which is responsible for releasing multi-field URL (MFURL) nodes in the VRML/BIFS scene graph handling code of GPAC. When MP4Box processes a malformed or specifically crafted media file, the function may operate on a node whose command node pointer was not properly initialized. Dereferencing this null pointer terminates the MP4Box process. Because MP4Box is commonly used in automated media pipelines, unattended job runners, and content ingestion workflows, repeated triggering can disrupt batch processing. Exploitation requires local access and low privileges. The impact is limited to availability of the affected process; no memory disclosure or code execution has been reported.

Root Cause

The root cause is improper handling of scene graph command nodes when releasing MFURL resources. The upstream patch changes direct assignment of com->node = node to the safer accessor gf_sg_command_set_node(com, node), which performs the necessary lifecycle bookkeeping. Related fuzzing-driven fixes add missing reference releases (for example, gf_filter_pck_unref(ctx->src_pck)) in adjacent parsers, indicating a class of resource-shutdown issues rather than a single isolated bug.

Attack Vector

Exploitation requires local access with low privileges (AV:L/PR:L). A user or automated process feeds a crafted media file to MP4Box or a linked GPAC utility. Parsing the file triggers the null pointer dereference and crashes the process. No user interaction and no network access are required.

// Patch excerpt from src/bifs/memory_decoder.c
static void BM_SetCommandNode(GF_Command *com, GF_Node *node)
{
-	com->node = node;
+	gf_sg_command_set_node(com, node);
 	gf_node_register(node, NULL);
}

// Patch excerpt from src/filters/reframe_av1.c
GF_AV1DmxCtx *ctx = gf_filter_get_udta(filter);
if (ctx->bs) gf_bs_del(ctx->bs);
if (ctx->indexes) gf_free(ctx->indexes);
+if (ctx->src_pck) gf_filter_pck_unref(ctx->src_pck);

gf_av1_reset_state(&ctx->state, GF_TRUE);
if (ctx->state.config) gf_odf_av1_cfg_del(ctx->state.config);

Source: GitHub Commit 49dee5c

Detection Methods for CVE-2026-90573

Indicators of Compromise

Repeated MP4Box process crashes or segmentation faults during media file parsing.
Core dumps containing stack frames referencing gf_sg_mfurl_del or BM_SetCommandNode.
Media ingestion or transcoding jobs failing on specific input files with abnormal exit codes.

Detection Strategies

Monitor process exit codes and crash telemetry for GPAC binaries (MP4Box, gpac, MP4Client).
Inventory installed GPAC versions and compare against commit f1219cde and release abi-16.23.
Enable core dump collection on hosts running GPAC to capture crashes for triage.

Monitoring Recommendations

Alert on unexpected termination of media processing services that wrap GPAC utilities.
Track file inputs feeding MP4Box in automated pipelines to correlate crashes with source files.
Review system logs (journalctl, dmesg) for SIGSEGV events tied to GPAC processes.

How to Mitigate CVE-2026-90573

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later, which includes commit 49dee5cad329cfed310c1682703df7daa47df31a.
Restrict which users and services can submit files to MP4Box on shared hosts.
Isolate media processing workloads in sandboxed containers or dedicated service accounts.

Patch Information

The fix is provided in upstream commit 49dee5c and included in release abi-16.23. GPAC uses a rolling release model, so downstream distributions should rebuild against a commit at or beyond the fix. Additional context is available in the GPAC issue tracker entry #3814 and the VulDB record for CVE-2026-90573.

Workarounds

Avoid processing untrusted media files with vulnerable GPAC builds until patched.
Wrap MP4Box invocations with resource limits (ulimit, systemd restart policies) to contain crashes.
Validate media inputs with a separate parser before handing them to GPAC in high-availability pipelines.

bash

# Verify installed GPAC version and rebuild against the patched release
MP4Box -version
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc) && sudo make install
MP4Box -version