CVE-2026-90578: GPAC MP4Box Use After Free Vulnerability

CVE-2026-90578 Overview

CVE-2026-90578 is a use-after-free vulnerability in GPAC, an open-source multimedia framework, affecting versions up to commit f1219cde. The flaw resides in the gf_list_count function within utils/list.c, invoked by the MP4Box component. An attacker with local access can trigger the condition by supplying a crafted input to MP4Box, leading to memory corruption classified under [CWE-119]. A public exploit has been published, but exploitation requires local execution and low privileges. The issue is resolved in GPAC release abi-16.23 via patch 49dee5cad329cfed310c1682703df7daa47df31a.

Critical Impact
Local attackers can trigger memory corruption in MP4Box when processing malicious media files, potentially causing process crashes or limited memory disclosure.

Affected Products

GPAC framework versions up to commit f1219cde
MP4Box command-line multimedia packager
GPAC utils/list.c list-handling utility component

Discovery Timeline

2026-09-13 - CVE-2026-90578 published to NVD
2026-09-15 - Last updated in NVD database
Patch commit - 49dee5cad329cfed310c1682703df7daa47df31a merged into GPAC release abi-16.23

Technical Details for CVE-2026-90578

Vulnerability Analysis

The vulnerability is a use-after-free condition triggered when MP4Box calls gf_list_count on a list structure whose backing memory has already been released. GPAC processes complex multimedia container formats and maintains numerous internal lists of nodes, packets, and command objects. When lifetime management for these referenced objects is incorrect, subsequent operations dereference freed memory. The published exploit demonstrates a segmentation fault (SEGV) in gf_list_count, indicating the freed allocation is accessed during list enumeration. Impact scope covers confidentiality, integrity, and availability at a limited level, consistent with a local user manipulating input files handed to MP4Box.

Root Cause

The underlying defect involves missing reference tracking for objects stored in GPAC internal lists. In the BIFS memory decoder, command nodes were assigned directly with com->node = node rather than through the reference-aware setter. In the AV1 reframer filter, the source packet referenced by ctx->src_pck was not released during filter teardown. Both patterns allow the same allocation to be freed while an aliased pointer remains reachable, producing a use-after-free when gf_list_count later iterates the container.

Attack Vector

Exploitation requires local execution with low privileges. An attacker crafts a malformed multimedia file and invokes MP4Box against it, either directly or through an automated processing pipeline. There is no network attack surface and no user interaction beyond invoking the vulnerable binary on attacker-controlled input.

// Patch: src/bifs/memory_decoder.c
// Replaces direct assignment with reference-aware setter
static void BM_SetCommandNode(GF_Command *com, GF_Node *node)
{
-	com->node = node;
+	gf_sg_command_set_node(com, node);
	gf_node_register(node, NULL);
}

Source: GPAC Commit 49dee5c

// Patch: src/filters/reframe_av1.c
// Adds missing unref of source packet on filter finalize
	GF_AV1DmxCtx *ctx = gf_filter_get_udta(filter);
	if (ctx->bs) gf_bs_del(ctx->bs);
	if (ctx->indexes) gf_free(ctx->indexes);
+	if (ctx->src_pck) gf_filter_pck_unref(ctx->src_pck);

	gf_av1_reset_state(&ctx->state, GF_TRUE);
	if (ctx->state.config) gf_odf_av1_cfg_del(ctx->state.config);

Source: GPAC Commit 49dee5c

Detection Methods for CVE-2026-90578

Indicators of Compromise

Unexpected MP4Box process crashes with SIGSEGV during media file parsing
Core dumps referencing gf_list_count in the faulting call stack
Presence of GPAC binaries built from commits at or before f1219cde

Detection Strategies

Inventory hosts running GPAC and confirm the installed version against release abi-16.23 or later.
Enable AddressSanitizer or Valgrind builds of MP4Box in test environments to surface use-after-free triggers during file fuzzing.
Monitor batch media processing jobs for abnormal termination signals when consuming untrusted media.

Monitoring Recommendations

Log invocations of MP4Box including command-line arguments and input file paths.
Alert on repeated segmentation faults from GPAC utilities on shared or multi-tenant systems.
Track file provenance for media inputs processed by automated GPAC pipelines.

How to Mitigate CVE-2026-90578

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or a later version that includes patch 49dee5cad329cfed310c1682703df7daa47df31a.
Restrict MP4Box execution to trusted users and validated input sources.
Rebuild any downstream packages, containers, or media pipelines that statically link older GPAC libraries.

Patch Information

The fix is delivered in GPAC release abi-16.23 via commit 49dee5cad329cfed310c1682703df7daa47df31a. The patch introduces reference-aware node assignment in the BIFS memory decoder and releases the source packet in the AV1 reframer filter. Full details are available in the GPAC Commit Changes and the GPAC Issue Discussion.

Workarounds

Do not process untrusted multimedia files with vulnerable MP4Box builds.
Run MP4Box inside a sandbox or container with a non-privileged user and no persistent state.
Disable automated GPAC-based conversion services until the upgrade is deployed.

bash

# Verify installed GPAC version and upgrade from source
MP4Box -version

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc)
sudo make install