CVE-2026-90611: GPAC MP4Box Use-After-Free Vulnerability

CVE-2026-90611 Overview

CVE-2026-90611 is a reachable assertion vulnerability [CWE-617] in GPAC, an open-source multimedia framework. The flaw resides in the xmt_parse_element function of scene_manager/loader_xmt.c, part of the MP4Box component. Processing a crafted XMT input file triggers the assertion and terminates the process. Exploitation requires local access with low privileges and no user interaction. GPAC versions up to commit f1219cde are affected, and the maintainers resolved the issue in release abi-16.23 via commit afca1f1181668d85941d51ed1adf647807d5d975. A public exploit reference exists, though the practical impact is limited to denial of service against the MP4Box utility.

Critical Impact
A local attacker who can supply a malicious XMT file to MP4Box can trigger an assertion failure, causing the multimedia processing utility to abort.

Affected Products

GPAC multimedia framework up to commit f1219cde
GPAC MP4Box command-line utility
Builds shipping the scene_manager/loader_xmt.c XMT loader prior to abi-16.23

Discovery Timeline

2026-09-14 - CVE-2026-90611 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90611

Vulnerability Analysis

The vulnerability is a reachable assertion in GPAC's XMT (eXtensible MPEG-4 Textual) scene loader. When MP4Box parses an XMT document, the xmt_parse_element function performs input validation using assertion macros rather than defensive error handling. Malformed or unexpected element structures reach an assertion that evaluates to false, and the runtime aborts the process. The result is a denial of service against the parser rather than memory corruption or code execution.

The defect is classified as CWE-617 (Reachable Assertion). Reachable assertions occur when developer-facing invariants are exposed to attacker-controlled input paths. In production binaries where assertions remain enabled, the process terminates whenever the invariant fails. GPAC's fuzz-hardening commit removes several such abort paths and replaces them with structured error returns.

Root Cause

The root cause is the use of gf_assert and similar unchecked invariants inside the XMT element parser. The loader assumes well-formed input for specific structural fields, but the XMT format allows sufficient variability that fuzzed inputs can violate these assumptions. Because the assertions are compiled into release builds, any violation aborts MP4Box instead of returning a clean error to the caller.

Attack Vector

Exploitation requires local access. An attacker must be able to invoke MP4Box against a crafted XMT file, or induce another local user or automated pipeline to process such a file. Network exploitation is not possible directly, though multimedia processing pipelines that accept remote uploads could expose the parser indirectly.

// Patch excerpt from src/filters/reframe_mpgvid.c
// Replaces unchecked assertions with defensive validation
 		if (ftype) {
-			gf_assert(pck_data[0] == 0);
-			gf_assert(pck_data[1] == 0);
-			gf_assert(pck_data[2] == 1);
+			if (size < 3 || pck_data[0] != 0 || pck_data[1] != 0 || pck_data[2] != 1) {
+				gf_filter_pid_drop_packet(ctx->ipid);
+				gf_filter_pck_discard(dst_pck);
+				return GF_BAD_PARAM;
+			}

 			gf_filter_pck_set_framing(dst_pck, GF_TRUE, (full_frame || ctx->input_is_au_end) ? GF_TRUE : GF_FALSE);
 			gf_filter_pck_set_cts(dst_pck, ctx->cts);
// Source: https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975

The patch converts assertion-based validation into explicit boundary checks that return GF_BAD_PARAM, allowing the parser to reject malformed input gracefully instead of aborting.

Detection Methods for CVE-2026-90611

Indicators of Compromise

Unexpected SIGABRT termination of MP4Box processes during XMT file parsing.
Core dumps or crash logs referencing xmt_parse_element or scene_manager/loader_xmt.c.
XMT input files originating from untrusted users or upload pipelines processed by MP4Box.

Detection Strategies

Inventory endpoints and build servers running GPAC versions at or before commit f1219cde and flag them for upgrade.
Monitor process exit codes and audit logs for repeated MP4Box crashes tied to specific input files.
Include XMT-format samples in local fuzzing or CI validation to surface additional reachable assertions.

Monitoring Recommendations

Enable core-dump collection on hosts running MP4Box in automated pipelines to capture crash traces.
Alert on abnormal restart patterns for services that wrap MP4Box for media transcoding.
Log the origin and hash of every XMT file processed by shared media services to correlate crashes with input provenance.

How to Mitigate CVE-2026-90611

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later, which includes commit afca1f1181668d85941d51ed1adf647807d5d975.
Restrict MP4Box execution to trusted local users and remove SUID or shared-invocation configurations where possible.
Validate or sandbox any XMT input received from untrusted sources before invoking the parser.

Patch Information

The fix is included in GPAC release abi-16.23 and is tracked in GitHub Issue #3820. The upstream commit afca1f1181668d85941d51ed1adf647807d5d975 replaces multiple reachable assertions in the XMT loader and adjacent parsers with error-return paths. Downstream distributions rebuilding GPAC should pull this commit or the tagged release. Additional detail is available in the VulDB entry for CVE-2026-90611 and the Rick9 vulnerability write-up.

Workarounds

Run MP4Box inside a sandbox such as firejail, bubblewrap, or a container with restricted filesystem access.
Reject XMT inputs at the pipeline boundary until the patched release is deployed.
Wrap MP4Box invocations with a supervisor that gracefully handles abnormal termination and quarantines the offending file.

bash

# Verify installed GPAC version and rebuild from patched source
MP4Box -version 2>&1 | head -n 1

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j"$(nproc)" && sudo make install

# Sandboxed invocation example
firejail --net=none --private-tmp MP4Box -info /path/to/untrusted.xmt