CVE-2026-90613: GPAC MP4Box Buffer Overflow Vulnerability

CVE-2026-90613 Overview

CVE-2026-90613 is a reachable assertion vulnerability in GPAC, an open-source multimedia framework. The flaw affects the stbl_GetSampleInfos function in isomedia/stbl_read.c, part of the MP4Box component. Processing a crafted media file triggers the assertion and causes MP4Box to terminate abnormally.

The vulnerability requires local access and low privileges to exploit. It does not affect confidentiality or integrity but causes a limited denial-of-service condition. Exploit code has been publicly disclosed. The issue is fixed in GPAC release abi-16.23 through commit 49dee5cad329cfed310c1682703df7daa47df31a. This weakness is classified under CWE-617: Reachable Assertion.

Critical Impact
A local attacker can crash MP4Box by supplying a malformed MP4 file, disrupting multimedia processing workflows that depend on GPAC.

Affected Products

GPAC multimedia framework versions up to commit f1219cde
MP4Box command-line utility bundled with affected GPAC builds
Applications embedding the vulnerable isomedia/stbl_read.c code path

Discovery Timeline

2026-09-14 - CVE-2026-90613 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90613

Vulnerability Analysis

The vulnerability resides in stbl_GetSampleInfos, a function in the ISO Base Media File Format (ISOBMFF) parser under isomedia/stbl_read.c. When MP4Box parses the sample table box (stbl) of a malformed MP4 container, values derived from attacker-controlled input violate an internal invariant. The runtime assertion then fires and terminates the process.

Because the affected code path executes during normal media parsing, any workflow that hands untrusted MP4 files to MP4Box is exposed. The impact is limited to availability: the process aborts without memory corruption or information disclosure.

Root Cause

The root cause is missing input validation before an assertion check. Instead of returning a graceful error for malformed sample table entries, the parser relies on assert() to catch inconsistent state. Assertions are intended for programmer invariants, not for defending against untrusted input. This misuse converts a parsing error into an abnormal termination and falls under CWE-617: Reachable Assertion.

Attack Vector

Exploitation requires local access and the ability to invoke MP4Box on an attacker-supplied file. A user opening a malicious .mp4 file, an automated transcoding pipeline ingesting untrusted uploads, or a batch job processing shared media directories all present viable attack surfaces. Network exploitation is not applicable given the local attack vector.

// Fix from GPAC commit 49dee5cad329cfed310c1682703df7daa47df31a
// src/bifs/memory_decoder.c: safer node assignment through helper
 static void BM_SetCommandNode(GF_Command *com, GF_Node *node)
 {
-	com->node = node;
+	gf_sg_command_set_node(com, node);
 	gf_node_register(node, NULL);
 }

// src/filters/reframe_av1.c: release source packet reference on cleanup
 	GF_AV1DmxCtx *ctx = gf_filter_get_udta(filter);
 	if (ctx->bs) gf_bs_del(ctx->bs);
 	if (ctx->indexes) gf_free(ctx->indexes);
+	if (ctx->src_pck) gf_filter_pck_unref(ctx->src_pck);

 	gf_av1_reset_state(&ctx->state, GF_TRUE);
 	if (ctx->state.config) gf_odf_av1_cfg_del(ctx->state.config);
// Source: https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a

Detection Methods for CVE-2026-90613

Indicators of Compromise

Unexpected MP4Box process termination with an assertion failure message referencing stbl_read.c or stbl_GetSampleInfos
Core dumps or crash artifacts produced by MP4Box shortly after ingesting untrusted MP4 files
Presence of anomalously structured MP4 files, particularly those with malformed sample table (stbl) atoms, in ingestion or upload directories

Detection Strategies

Monitor process exit codes and stderr from MP4Box invocations for Assertion strings and abnormal termination patterns
Correlate crashes with file hashes of the last input processed to isolate malicious media samples
Track GPAC binary versions across endpoints and flag any installation predating release abi-16.23

Monitoring Recommendations

Enable audit logging on directories where automated pipelines pass files to MP4Box
Alert on repeated MP4Box crashes originating from the same user, service account, or upload source
Retain crash dumps for forensic analysis to confirm the assertion path matches CVE-2026-90613

How to Mitigate CVE-2026-90613

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems that run MP4Box against untrusted input
Inventory scripts, transcoding services, and packaged applications that embed GPAC to confirm patched versions are in use
Restrict MP4Box execution to trusted media sources until patching is complete

Patch Information

The fix is contained in commit 49dee5cad329cfed310c1682703df7daa47df31a and shipped in the GPAC abi-16.23 release. Users should build from the tagged release or install updated packages from their distribution once available. Technical background is documented in GPAC Issue #3822 and the VulDB entry for CVE-2026-90613.

Workarounds

Run MP4Box under a supervised process wrapper that restarts the service after crashes to preserve availability
Sandbox MP4Box using seccomp, AppArmor, or containers with minimal privileges to contain the impact of a forced termination
Validate MP4 container structure with an independent parser before invoking MP4Box on user-supplied files

bash

# Build and install the patched GPAC release
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure
make -j$(nproc)
sudo make install

# Verify the installed version
MP4Box -version