CVE-2026-90686: GPAC MP4Box Buffer Overflow Vulnerability

CVE-2026-90686 Overview

CVE-2026-90686 is a memory corruption vulnerability in GPAC, an open-source multimedia framework, affecting versions up to commit f1219cde. The flaw resides in the gf_bt_report function within scene_manager/loader_bt.c, a component of the MP4Box utility. Processing a crafted input file triggers memory corruption in the parser. The issue is classified as [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). A public exploit exists, and upgrading to version abi-16.23 resolves the issue. The fix is tracked in commit afca1f1181668d85941d51ed1adf647807d5d975.

Critical Impact
Attackers can trigger memory corruption in MP4Box by supplying a crafted scene description file, potentially leading to process crash or availability loss in automated media-processing pipelines.

Affected Products

GPAC multimedia framework up to commit f1219cde
MP4Box utility bundled with affected GPAC builds
Any downstream tooling embedding the vulnerable scene_manager/loader_bt.c parser

Discovery Timeline

2026-09-14 - CVE-2026-90686 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90686

Vulnerability Analysis

The vulnerability lives in gf_bt_report, part of the BT (BIFS Textual) scene loader in GPAC's scene_manager/loader_bt.c. MP4Box invokes this loader when importing or converting BT-format scene descriptions into MP4 containers. Insufficient validation during report or packet handling allows a malformed input to corrupt process memory. Because MP4Box is frequently invoked headlessly by build systems, media pipelines, and web services that accept user-supplied media, the parser can be reached remotely without user interaction.

Root Cause

The defect is a memory safety issue [CWE-119] rooted in missing bounds and validity checks on parsed data before it is passed to downstream operations. The patch replaces assertion-based checks with explicit validation and safe allocation helpers, and it hardens related parsers used during fuzzing. Assertions are removed at runtime in production builds, so malformed input previously flowed into memory operations without protective guards.

Attack Vector

An attacker delivers a crafted BT scene file to any workflow that feeds files into MP4Box or a GPAC-based service. Because parsing occurs before authentication in typical media-ingest scenarios, no privileges or user interaction are required. Successful exploitation corrupts memory in the MP4Box process. The CVSS 4.0 vector reflects availability impact only, with the confidentiality and integrity subscores rated none.

// Patch excerpt from src/filters/reframe_mpgvid.c
// Replaces assertions with runtime bounds and value checks
		if (ftype) {
-			gf_assert(pck_data[0] == 0);
-			gf_assert(pck_data[1] == 0);
-			gf_assert(pck_data[2] == 1);
+			if (size < 3 || pck_data[0] != 0 || pck_data[1] != 0 || pck_data[2] != 1) {
+				gf_filter_pid_drop_packet(ctx->ipid);
+				gf_filter_pck_discard(dst_pck);
+				return GF_BAD_PARAM;
+			}

			gf_filter_pck_set_framing(dst_pck, GF_TRUE, (full_frame || ctx->input_is_au_end) ? GF_TRUE : GF_FALSE);
			gf_filter_pck_set_cts(dst_pck, ctx->cts);
// Source: https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975

A second hunk in src/laser/lsr_dec.c replaces an ad-hoc gf_malloc with the GF_SAFEALLOC macro for SVG_ViewBox allocations, eliminating an unchecked-allocation pattern in the LASeR decoder. Both changes appear in the same commit that fixes CVE-2026-90686. See the GitHub CVE-Submit Document and GitHub Issue #3798 for reproduction context.

Detection Methods for CVE-2026-90686

Indicators of Compromise

Unexpected crashes or segmentation faults in MP4Box processes when parsing BT-format scene files.
Presence of GPAC binaries built from commits at or before f1219cde on media-processing hosts.
Core dumps referencing gf_bt_report or symbols within scene_manager/loader_bt.c.

Detection Strategies

Inventory endpoints and containers for GPAC installs and compare versions against the fixed release abi-16.23.
Log invocations of MP4Box on servers accepting user-supplied media and flag runs against .bt inputs from untrusted sources.
Monitor process exit codes and abnormal termination signals from media-ingest workers to identify parser crashes.

Monitoring Recommendations

Alert on repeated MP4Box process failures originating from the same upload session or client IP.
Capture the input file path and hash on parser failure to enable forensic reconstruction.
Forward media-pipeline crash telemetry into a centralized data lake for correlation with upload activity.

How to Mitigate CVE-2026-90686

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems that run MP4Box.
Rebuild container images and downstream distributions that vendor GPAC binaries.
Restrict MP4Box execution to sandboxed workers with resource limits and no network egress.

Patch Information

The fix is delivered in commit afca1f1181668d85941d51ed1adf647807d5d975 and included in release abi-16.23. The patch replaces assertion-based checks with explicit validation in reframe_mpgvid.c and switches to GF_SAFEALLOC in lsr_dec.c. Refer to the VulDB entry for CVE-2026-90686 for tracking metadata.

Workarounds

Reject or pre-validate .bt scene description files before passing them to MP4Box.
Run MP4Box under a low-privilege service account inside a seccomp or AppArmor confinement.
Disable BT scene loading in pipelines that only require standard MP4 remuxing.

bash

# Verify installed GPAC version and force upgrade to abi-16.23
MP4Box -version 2>&1 | head -n 1

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc) && sudo make install

# Optional: sandbox MP4Box execution with systemd-run
systemd-run --uid=media --gid=media \
  --property=NoNewPrivileges=yes \
  --property=ProtectSystem=strict \
  --property=PrivateNetwork=yes \
  MP4Box -bt input.bt -out output.mp4