CVE-2026-90684: GPAC MP4Box DOS Vulnerability

CVE-2026-90684 Overview

CVE-2026-90684 is a reachable assertion vulnerability [CWE-617] in GPAC, an open-source multimedia framework used for packaging, streaming, and playback of MPEG content. The flaw resides in the gf_node_get_field_count function within scenegraph/base_scenegraph.c, part of the MP4Box component. Processing a crafted input triggers an assertion failure that terminates the process, resulting in a local denial-of-service condition. The issue affects GPAC builds up to commit f1219cde and is resolved in release abi-16.23 via commit 49dee5cad329cfed310c1682703df7daa47df31a. A public exploit has been disclosed, though the attack requires local access and user interaction to invoke MP4Box on the malicious file.

Critical Impact
Successful exploitation causes a controlled process crash in MP4Box, disrupting media processing workflows that rely on GPAC.

Affected Products

GPAC multimedia framework up to commit f1219cde
MP4Box command-line utility bundled with vulnerable GPAC builds
Downstream tooling that embeds the affected scenegraph/base_scenegraph.c code path

Discovery Timeline

2026-09-14 - CVE-2026-90684 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90684

Vulnerability Analysis

The defect is a reachable assertion in GPAC's scene graph handling. When MP4Box parses a crafted media file, execution reaches gf_node_get_field_count in scenegraph/base_scenegraph.c with a node pointer that fails an internal assert(node) check. The assertion aborts the process instead of returning an error, producing a deterministic crash. Because the failing precondition can be induced through file input, an attacker who can convince a user to run MP4Box against a supplied file can reliably terminate the utility. The condition is limited to availability impact on the local host; it does not expose confidentiality or integrity outcomes.

Root Cause

The root cause is missing defensive validation prior to node dereference. The scene graph command handling accepted a node reference without routing it through a registration helper that ensures the graph state is consistent, leaving a code path where a null or unregistered node reached the assertion. The fix rewires command node assignment to go through gf_sg_command_set_node and adds packet reference cleanup in the AV1 reframer, hardening related node memory handling paths.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted input file and induces the victim to process it with MP4Box. There is no network attack surface and no privilege escalation. The observable outcome is a denial-of-service condition against the invoking process.

// Patch excerpt: src/bifs/memory_decoder.c
static void BM_SetCommandNode(GF_Command *com, GF_Node *node)
{
-	com->node = node;
+	gf_sg_command_set_node(com, node);
 	gf_node_register(node, NULL);
}

Source: GitHub Commit 49dee5c

// Patch excerpt: src/filters/reframe_av1.c
	GF_AV1DmxCtx *ctx = gf_filter_get_udta(filter);
	if (ctx->bs) gf_bs_del(ctx->bs);
	if (ctx->indexes) gf_free(ctx->indexes);
+	if (ctx->src_pck) gf_filter_pck_unref(ctx->src_pck);

	gf_av1_reset_state(&ctx->state, GF_TRUE);
	if (ctx->state.config) gf_odf_av1_cfg_del(ctx->state.config);

Source: GitHub Commit 49dee5c

Detection Methods for CVE-2026-90684

Indicators of Compromise

Abnormal termination of MP4Box accompanied by an assert(node) failure message on stderr.
Core dumps generated by MP4Box immediately after opening a user-supplied media file.
Repeated short-lived MP4Box process invocations that exit non-zero when processing untrusted content.

Detection Strategies

Monitor process exit codes and crash telemetry for MP4Box across build agents, media pipelines, and analyst workstations.
Inspect installed GPAC versions and flag any build predating release abi-16.23 or containing commit f1219cde.
Review file provenance for media assets processed by MP4Box and correlate crashes with recently introduced inputs.

Monitoring Recommendations

Forward host crash logs and abrt/systemd-coredump events to a central logging platform for correlation.
Alert on repeated MP4Box failures originating from the same source directory or user session.
Track deployment of the abi-16.23 release across systems that package GPAC as a dependency.

How to Mitigate CVE-2026-90684

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all affected systems.
Avoid processing untrusted media files with MP4Box until the patched version is installed.
Rebuild any downstream packages or containers that statically link GPAC libraries.

Patch Information

The fix is available in GPAC release abi-16.23 and is delivered by commit 49dee5cad329cfed310c1682703df7daa47df31a. See the GitHub Commit 49dee5c for the full patch and GitHub Issue #3824 for the reported reproduction details.

Workarounds

Restrict MP4Box execution to trusted files and controlled build inputs.
Sandbox MP4Box invocations using process isolation such as firejail, bubblewrap, or containerized runners with resource limits.
Remove or disable MP4Box on systems where it is not required until the upgrade is applied.

bash

# Build and install the patched GPAC release
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j"$(nproc)"
sudo make install
MP4Box -version