Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-90685

CVE-2026-90685: GPAC MP4Box Use-After-Free Vulnerability

CVE-2026-90685 is a use-after-free vulnerability in GPAC MP4Box that triggers a reachable assertion through the lsr_exec_command_list function. This article covers technical details, affected versions, and mitigation steps.

Published:

CVE-2026-90685 Overview

CVE-2026-90685 is a reachable assertion vulnerability in GPAC, an open-source multimedia framework. The flaw resides in the lsr_exec_command_list function within laser/lsr_dec.c, part of the MP4Box component. Processing a crafted LASeR (Lightweight Application Scene Representation) stream triggers an assertion failure, which terminates the process. Exploitation requires local access and user interaction to supply the malicious file. The issue affects GPAC versions up to commit f1219cde and is resolved in release abi-16.23 via patch commit afca1f1181668d85941d51ed1adf647807d5d975. The vulnerability is tracked under [CWE-617: Reachable Assertion].

Critical Impact

An authenticated local user can crash the MP4Box process by supplying a malformed LASeR-encoded media file, resulting in denial of service for media processing workflows.

Affected Products

  • GPAC multimedia framework up to commit f1219cde
  • MP4Box command-line utility (LASeR decoder component)
  • Applications embedding the GPAC laser/lsr_dec.c decoder

Discovery Timeline

  • 2026-09-14 - CVE-2026-90685 published to NVD
  • 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90685

Vulnerability Analysis

The defect is a reachable assertion in the LASeR command list executor. When MP4Box parses a malformed scene stream, the lsr_exec_command_list code path reaches an assert() statement whose invariant does not hold for attacker-controlled input. The assertion aborts the process rather than returning an error, converting untrusted input into an unrecoverable termination.

Because the crash is triggered by data validation performed via assert(), the code fails to reject invalid packets gracefully. The upstream fix replaces assertion-based validation with explicit input checks that return GF_BAD_PARAM and drop the offending packet, keeping the parser alive. A related change in src/laser/lsr_dec.c also switches an ad hoc allocation to GF_SAFEALLOC for the SVG_ViewBox datatype, closing an adjacent memory-safety issue in the same LASeR decoder.

Root Cause

The root cause is improper input validation combined with the use of assert() for runtime checks on untrusted data. Assertions are compiled as fatal aborts in debug builds and may be stripped in release builds, so they are unsuitable for validating attacker-controlled bitstream fields. The LASeR decoder assumed structural invariants (for example, packet framing bytes 00 00 01) that a malformed stream can violate.

Attack Vector

Exploitation requires local access, low privileges, and user interaction (opening or processing a crafted file). A local attacker delivers a malformed LASeR/SVG stream, typically inside an MP4 container, and induces the victim to process it with MP4Box or a GPAC-based application. The result is process termination without code execution or data disclosure.

c
// Patch excerpt from src/filters/reframe_mpgvid.c
// Replaces fatal gf_assert() calls with graceful error handling
		if (ftype) {
-			gf_assert(pck_data[0] == 0);
-			gf_assert(pck_data[1] == 0);
-			gf_assert(pck_data[2] == 1);
+			if (size < 3 || pck_data[0] != 0 || pck_data[1] != 0 || pck_data[2] != 1) {
+				gf_filter_pid_drop_packet(ctx->ipid);
+				gf_filter_pck_discard(dst_pck);
+				return GF_BAD_PARAM;
+			}

			gf_filter_pck_set_framing(dst_pck, GF_TRUE, (full_frame || ctx->input_is_au_end) ? GF_TRUE : GF_FALSE);
			gf_filter_pck_set_cts(dst_pck, ctx->cts);

Source: GPAC Commit afca1f1

c
// Patch excerpt from src/laser/lsr_dec.c
// Replaces manual allocation with GF_SAFEALLOC for the ViewBox datatype
	case SVG_ViewBox_datatype:
-		f_val = (Fixed*)gf_malloc(sizeof(Fixed));
-		if (!f_val) {
-			lsr->last_error = GF_OUT_OF_MEM;
-		} else {
-			*f_val = lsr_read_fixed_16_8(lsr, "floatValue");
-		}
-		return f_val;
+		SVG_ViewBox *viewbox;
+		GF_SAFEALLOC(viewbox, SVG_ViewBox)
+		return viewbox;

Source: GPAC Commit afca1f1

Detection Methods for CVE-2026-90685

Indicators of Compromise

  • Unexpected abort or SIGABRT termination of MP4Box or GPAC-based media pipelines during LASeR/SVG stream parsing.
  • Core dumps referencing lsr_exec_command_list in laser/lsr_dec.c.
  • Suspicious MP4 or LASeR files delivered via email, file shares, or media ingestion queues that consistently crash the parser.

Detection Strategies

  • Enumerate installed GPAC versions across endpoints and build servers; flag any commit prior to abi-16.23.
  • Monitor for repeated process crashes of MP4Box originating from the same user or file source, which may indicate iterative fuzzing or targeted DoS.
  • Correlate media-processing job failures with the file path and hash of the input to identify malformed samples.

Monitoring Recommendations

  • Enable operating-system crash reporting (Windows Error Reporting, systemd-coredump, abrt) and forward reports to a central log store.
  • Track process exit codes for automated media conversion pipelines and alert on non-zero terminations tied to LASeR content.
  • Log file provenance for content submitted to any GPAC-backed service so crash-inducing inputs can be traced to their origin.

How to Mitigate CVE-2026-90685

Immediate Actions Required

  • Upgrade GPAC to release abi-16.23 or later, which contains commit afca1f1181668d85941d51ed1adf647807d5d975.
  • Restrict MP4Box execution to trusted users and sandboxed accounts until the upgrade is complete.
  • Reject or quarantine untrusted LASeR/SVG streams at ingestion boundaries.

Patch Information

The vendor fix is available in the GPAC abi-16.23 release. The patch is committed as afca1f1181668d85941d51ed1adf647807d5d975 and is discussed in GPAC Issue #3825. Additional context is available in the CVE Summit vulnerability report and the VulDB entry for CVE-2026-90685.

Workarounds

  • Run MP4Box inside a sandbox (for example, firejail, bubblewrap, or a container) with automatic restart to contain crashes.
  • Disable LASeR/SVG scene decoding in workflows that do not require it.
  • Validate MIME types and file structure before invoking MP4Box on user-supplied media.
bash
# Verify installed GPAC version and upgrade
MP4Box -version 2>&1 | head -n 1

# Build and install the patched release from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j"$(nproc)" && sudo make install

# Confirm the fix commit is present
git log --oneline | grep afca1f1181668d85941d51ed1adf647807d5d975

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne