CVE-2026-90683: GPAC MP4Box Use-After-Free Vulnerability

CVE-2026-90683 Overview

CVE-2026-90683 is a reachable assertion vulnerability [CWE-617] in GPAC, an open-source multimedia framework. The flaw resides in the gf_node_unregister function within scenegraph/base_scenegraph.c, part of the MP4Box component. An attacker with local access and low privileges can trigger the assertion by supplying a crafted input, causing the process to terminate abnormally. The issue affects GPAC builds up to commit f1219cde and is resolved in release abi-16.23 via patch 49dee5cad329cfed310c1682703df7daa47df31a. Public exploit details are available through VulDB and a third-party writeup.

Critical Impact
Local attackers can trigger a reachable assertion in MP4Box, resulting in process termination and denial of service against the media processing workflow.

Affected Products

GPAC multimedia framework up to commit f1219cde
GPAC MP4Box command-line utility
GPAC scene graph component (scenegraph/base_scenegraph.c)

Discovery Timeline

2026-09-14 - CVE-2026-90683 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90683

Vulnerability Analysis

The vulnerability is a reachable assertion failure classified under [CWE-617]. GPAC's MP4Box utility processes media containers and builds an internal scene graph to manage nodes and their references. When a node is unregistered through gf_node_unregister, the function contains an assert(num_instances) check validating that at least one instance of the node exists. Attacker-controlled input can drive the internal state so that this invariant is violated, causing the assertion to fire and the process to abort. Because MP4Box frequently runs as part of automated media pipelines, repeated crashes disrupt transcoding, packaging, and analysis workflows.

Root Cause

The underlying issue stems from insufficient validation of node reference counts before the assertion is evaluated. The scene graph maintains instance counters that can be desynchronized when malformed BIFS commands or scene updates are parsed. Related fixes in the same patch address unreferenced packet handling in reframe_av1.c and command-node assignment in memory_decoder.c, indicating a broader class of node lifecycle bugs.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker supplies a crafted media file to MP4Box for processing. The parser walks the scene graph and eventually invokes gf_node_unregister on a node whose instance count is zero, triggering the assertion and terminating the process.

// Patch excerpt: src/bifs/memory_decoder.c
static void BM_SetCommandNode(GF_Command *com, GF_Node *node)
{
-	com->node = node;
+	gf_sg_command_set_node(com, node);
 	gf_node_register(node, NULL);
}

// Patch excerpt: src/filters/reframe_av1.c
	GF_AV1DmxCtx *ctx = gf_filter_get_udta(filter);
	if (ctx->bs) gf_bs_del(ctx->bs);
	if (ctx->indexes) gf_free(ctx->indexes);
+	if (ctx->src_pck) gf_filter_pck_unref(ctx->src_pck);

	gf_av1_reset_state(&ctx->state, GF_TRUE);
	if (ctx->state.config) gf_odf_av1_cfg_del(ctx->state.config);

Source: GPAC Commit 49dee5c

Detection Methods for CVE-2026-90683

Indicators of Compromise

Abnormal termination of MP4Box processes with assertion failure messages referencing num_instances in base_scenegraph.c.
Core dumps or crash reports generated by GPAC binaries when parsing untrusted media inputs.
Repeated processing failures on specific media files submitted through shared upload or transcoding pipelines.

Detection Strategies

Monitor process exit codes and stderr output from MP4Box and related GPAC binaries for assertion strings.
Enable core dump collection on media processing hosts and alert on new crash signatures involving gf_node_unregister.
Correlate crash events with the input file that was being processed to identify potentially malicious samples.

Monitoring Recommendations

Track GPAC binary versions across build and production hosts to identify systems still on pre-abi-16.23 builds.
Log all invocations of MP4Box in automated pipelines and flag jobs that terminate with non-zero exit codes from parsing errors.
Review file provenance for any media input that triggers assertion failures to determine whether the source is trusted.

How to Mitigate CVE-2026-90683

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later, which includes patch 49dee5cad329cfed310c1682703df7daa47df31a.
Restrict MP4Box execution to trusted users and avoid processing untrusted media files with unprivileged service accounts that share resources with other workloads.
Isolate media processing jobs in sandboxes or ephemeral containers so that a crash does not disrupt adjacent services.

Patch Information

The fix is delivered in GPAC release abi-16.23 under commit 49dee5cad329cfed310c1682703df7daa47df31a. The patch corrects node registration in BM_SetCommandNode by routing through gf_sg_command_set_node and adds proper packet unreferencing in the AV1 reframer. See the GPAC Release ABI-16.23 and the GPAC Issue Tracker entry for details.

Workarounds

Disable or block use of MP4Box on hosts that do not require it until the upgrade is applied.
Validate media file sources and reject inputs from untrusted parties in automated ingestion pipelines.
Run MP4Box under a supervisor that automatically restarts the process and quarantines the offending input for review.

bash

# Verify installed GPAC version and upgrade path
MP4Box -version

# Build and install the patched release from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc)
sudo make install

# Confirm the fix is present
MP4Box -version 2>&1 | grep -i "abi-16.23"