CVE-2026-90609: GPAC MP4Box Use-After-Free Vulnerability

CVE-2026-90609 Overview

CVE-2026-90609 is a null pointer dereference vulnerability in GPAC, the open-source multimedia framework, affecting builds up to commit f1219cde. The flaw resides in an unknown function within scenegraph/vrml_tools.c, reachable through the MP4Box component when processing crafted input. Exploitation requires local access with low privileges and results in a process crash affecting availability. The issue is tracked under CWE-404: Improper Resource Shutdown or Release and has been publicly disclosed. The GPAC maintainers addressed the issue in release abi-16.23 via commit 49dee5cad329cfed310c1682703df7daa47df31a.

Critical Impact
A local attacker with low privileges can trigger a null pointer dereference in MP4Box, causing the process to crash and denying multimedia processing services.

Affected Products

GPAC multimedia framework up to commit f1219cde
MP4Box component built from affected GPAC sources
Applications embedding the vulnerable GPAC scenegraph library

Discovery Timeline

2026-09-14 - CVE-2026-90609 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90609

Vulnerability Analysis

The vulnerability affects the VRML (Virtual Reality Modeling Language) scenegraph handling code in scenegraph/vrml_tools.c. According to the public vulnerability report, the flaw is triggered inside gf_node_set_cyclic_traverse_flag, which dereferences a scenegraph node pointer without validating that it is non-null.

When MP4Box parses a malformed BIFS or VRML scene, the command structure can reference a node pointer that was never properly initialized. Invoking the traversal routine on this null pointer causes a segmentation fault. The impact is limited to availability, as the crash terminates the parsing process without exposing memory contents or enabling code execution.

Root Cause

The root cause is missing null validation before dereferencing scenegraph nodes assigned to commands. The prior implementation of BM_SetCommandNode directly assigned a node pointer into the command structure without invoking the setter that maintains scenegraph invariants. Related resource-management gaps in AV1 reframing code also failed to release referenced packets, compounding the memory hygiene issues addressed by the patch.

Attack Vector

Exploitation requires local access to a system running MP4Box and the ability to supply a crafted multimedia file to the tool. An attacker constructs a scene description that produces an unset node reference during BIFS command processing. When MP4Box reaches the affected traversal path, the process crashes. The attack cannot be performed remotely and does not yield elevated privileges or data disclosure.

// Patch excerpt: src/bifs/memory_decoder.c
static void BM_SetCommandNode(GF_Command *com, GF_Node *node)
{
-	com->node = node;
+	gf_sg_command_set_node(com, node);
 	gf_node_register(node, NULL);
}

// Patch excerpt: src/filters/reframe_av1.c
	GF_AV1DmxCtx *ctx = gf_filter_get_udta(filter);
	if (ctx->bs) gf_bs_del(ctx->bs);
	if (ctx->indexes) gf_free(ctx->indexes);
+	if (ctx->src_pck) gf_filter_pck_unref(ctx->src_pck);

	gf_av1_reset_state(&ctx->state, GF_TRUE);
	if (ctx->state.config) gf_odf_av1_cfg_del(ctx->state.config);

Source: GPAC Commit 49dee5c

Detection Methods for CVE-2026-90609

Indicators of Compromise

Unexpected MP4Box process termination with SIGSEGV when parsing user-supplied media files
Core dump artifacts referencing gf_node_set_cyclic_traverse_flag or scenegraph/vrml_tools.c
Presence of GPAC binaries built from source revisions at or before commit f1219cde

Detection Strategies

Inventory installed GPAC packages and compare versions against the fixed release abi-16.23
Enable core dump collection on hosts running MP4Box and alert on crashes originating in libgpac
Review batch processing pipelines that ingest untrusted BIFS or VRML scene content for repeated failures

Monitoring Recommendations

Forward crash telemetry from media conversion hosts to a centralized logging or SIEM platform for correlation
Track file provenance for inputs submitted to MP4Box in shared or multi-user environments
Monitor for anomalous local users invoking MP4Box with unusual input files outside normal workflows

How to Mitigate CVE-2026-90609

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later, which includes patch commit 49dee5cad329cfed310c1682703df7daa47df31a
Rebuild any downstream applications that statically link against affected GPAC libraries
Restrict MP4Box usage to trusted local users until patched builds are deployed

Patch Information

The fix is available in the GPAC abi-16.23 release. The patch modifies src/bifs/memory_decoder.c to route node assignment through gf_sg_command_set_node, which enforces scenegraph invariants and prevents the null dereference. See the upstream commit and the associated issue tracker entry for full context.

Workarounds

Avoid processing untrusted BIFS or VRML scene files with vulnerable MP4Box builds
Sandbox MP4Box execution using containers, seccomp, or AppArmor profiles to contain crashes
Validate multimedia inputs against expected schemas before submission to GPAC-based pipelines

bash

# Verify installed GPAC version and upgrade from source
MP4Box -version 2>&1 | head -n 2

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc)
sudo make install