CVE-2026-90610: GPAC MP4Box Buffer Overflow Vulnerability

CVE-2026-90610 Overview

CVE-2026-90610 is a buffer over-read vulnerability in GPAC, an open-source multimedia framework, affecting versions up to commit f1219cde. The flaw resides in the gf_svg_attributes_copy function within scenegraph/svg_attributes.c, part of the MP4Box component. Processing a malformed SVG attribute triggers an out-of-bounds read on the heap. Exploitation requires local access and low privileges, and a public exploit is available. The issue is tracked under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Upgrading to release abi-16.23 resolves the vulnerability through commit afca1f1181668d85941d51ed1adf647807d5d975.

Critical Impact
A local attacker can trigger a heap buffer over-read of approximately 20 bytes in MP4Box, potentially leaking adjacent heap memory or crashing the process during SVG attribute copying operations.

Affected Products

GPAC multimedia framework up to commit f1219cde
MP4Box command-line utility (bundled with GPAC)
GPAC releases prior to abi-16.23

Discovery Timeline

2026-09-14 - CVE-2026-90610 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90610

Vulnerability Analysis

The vulnerability is a heap buffer over-read of size 20 bytes in the gf_svg_attributes_copy function located in src/scenegraph/svg_attributes.c. MP4Box processes SVG attributes when handling multimedia containers that include Scalable Vector Graphics (SVG) content. When copying SVG attribute structures, the function reads memory beyond the allocated heap buffer boundary.

The over-read is triggered locally when a user processes a crafted input file with MP4Box. While the flaw does not permit code execution, it can leak adjacent heap memory contents or cause the process to crash. The associated patch also hardens src/laser/lsr_dec.c and src/filters/reframe_mpgvid.c against related memory-safety issues reported through fuzzing.

Root Cause

The root cause is missing validation of attribute sizes and types during structure copying in the SVG attribute handling path. The gf_svg_attributes_copy routine assumes source buffer bounds without verifying allocation size. The patch introduces stricter allocation and validation using GF_SAFEALLOC for SVG_ViewBox structures and adds explicit length checks before reading packet data in the MPEG video reframer.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker supplies a specially crafted media file containing malformed SVG attributes to MP4Box. When the target parses the file, the vulnerable copy operation reads past the intended heap boundary. The exploit has been publicly disclosed through the GPAC vulnerability write-up.

// Patch excerpt from src/laser/lsr_dec.c (abi-16.23)
case SVG_ViewBox_datatype:
    SVG_ViewBox *viewbox;
    GF_SAFEALLOC(viewbox, SVG_ViewBox)
    return viewbox;
case SMIL_KeyTimes_datatype/*ITYPE_keyTime*/:
{
    ListOfXXX *res;
// Source: https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975

// Patch excerpt from src/filters/reframe_mpgvid.c (abi-16.23)
if (ftype) {
    if (size < 3 || pck_data[0] != 0 || pck_data[1] != 0 || pck_data[2] != 1) {
        gf_filter_pid_drop_packet(ctx->ipid);
        gf_filter_pck_discard(dst_pck);
        return GF_BAD_PARAM;
    }
    gf_filter_pck_set_framing(dst_pck, GF_TRUE, (full_frame || ctx->input_is_au_end) ? GF_TRUE : GF_FALSE);
// Source: https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975

Detection Methods for CVE-2026-90610

Indicators of Compromise

MP4Box process crashes or abnormal termination when parsing SVG-bearing media files.
AddressSanitizer or Valgrind reports flagging gf_svg_attributes_copy with heap-buffer-overflow READ of size 20.
Unexpected core dumps referencing libgpac frames in scenegraph/svg_attributes.c.

Detection Strategies

Inventory endpoints and build servers for GPAC versions preceding abi-16.23 using package managers or file hashes.
Monitor invocations of MP4Box against untrusted media files, particularly containers embedding SVG payloads.
Deploy fuzzing and sanitizer-instrumented builds in CI pipelines that use GPAC libraries to catch related memory-safety regressions.

Monitoring Recommendations

Alert on repeated MP4Box crash signals (SIGSEGV, SIGABRT) in host telemetry.
Track file provenance for media processed by MP4Box in automation pipelines and transcoding workflows.
Correlate multimedia processing errors with user or service accounts that handle externally sourced files.

How to Mitigate CVE-2026-90610

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all affected systems.
Restrict MP4Box execution to trusted input files until the patch is applied.
Audit CI/CD and media-processing pipelines that invoke GPAC binaries or link against libgpac.

Patch Information

The fix is delivered in commit afca1f1181668d85941d51ed1adf647807d5d975 and released as abi-16.23. The commit addresses the SVG attribute copy path along with related fuzzing findings in the LASeR decoder and MPEG video reframer. Refer to GitHub Issue #3819 and the VulDB entry for CVE-2026-90610 for full context.

Workarounds

Avoid processing untrusted or attacker-supplied media files with MP4Box on unpatched systems.
Run MP4Box in a sandboxed or containerized environment with reduced privileges and no access to sensitive memory regions.
Disable SVG-related processing paths in downstream tooling if configurable, until upgrading to abi-16.23.

bash

# Upgrade GPAC to the patched release from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure
make -j$(nproc)
sudo make install
MP4Box -version