CVE-2026-90687: GPAC MP4Box Use After Free Vulnerability

CVE-2026-90687 Overview

CVE-2026-90687 is a use-after-free vulnerability in GPAC, an open-source multimedia framework, up to commit f1219cde. The flaw resides in the gf_node_changed_internal function within scenegraph/base_scenegraph.c, part of the MP4Box component. An attacker can trigger memory corruption by supplying a crafted input file, and the exploit has been publicly disclosed. The issue is resolved in release abi-16.23 via patch commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24.

Critical Impact
Remote attackers can exploit the use-after-free condition through crafted media files, potentially causing process crashes or memory corruption in applications processing untrusted content with MP4Box.

Affected Products

GPAC multimedia framework versions up to commit f1219cde
MP4Box component (scenegraph subsystem)
GPAC releases prior to abi-16.23

Discovery Timeline

2026-09-14 - CVE-2026-90687 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90687

Vulnerability Analysis

The vulnerability is classified as a use-after-free condition [CWE-119] in the GPAC scenegraph handling code. It occurs when gf_node_changed_internal in scenegraph/base_scenegraph.c accesses a scene graph node after the underlying memory has been released. Attackers can trigger this state remotely by supplying a crafted scene file to MP4Box, which processes untrusted multimedia input.

User interaction is required, typically opening or converting a malicious media file. Successful exploitation may lead to process crashes, information leakage from freed memory, or, depending on heap layout, control-flow corruption. Because a public disclosure exists, defenders should assume that proof-of-concept material is circulating for testing.

Root Cause

The root cause is missing lifecycle tracking of scene graph nodes during change notification. When a parent or referenced node is unregistered without removing it from an internal tracking list, subsequent callbacks dereference stale pointers. The upstream patch addresses this by explicitly removing nodes from parser->def_nodes before unregistering them in the loader error path, closing the window where dangling references persist.

Attack Vector

Exploitation requires an attacker to deliver a crafted MP4 or scene description file that a victim processes with MP4Box or an application linked against a vulnerable GPAC build. Delivery channels include email attachments, web downloads, and automated media processing pipelines. Network reachability alone is insufficient; the victim must invoke the parser on the malicious content.

// Security patch in src/scene_manager/loader_bt.c
// fuzz: fix afca1f1 build + more fixes
 	return node;
 
 err:
+	gf_list_del_item(parser->def_nodes, node);
 	gf_node_unregister(node, parent);
 	if (name) gf_free(name);
 	return NULL;
// Source: https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24

The patch removes the node from the parser's def_nodes tracking list before unregistering it, preventing later code paths from operating on the freed node reference.

Detection Methods for CVE-2026-90687

Indicators of Compromise

Unexpected crashes or segmentation faults in MP4Box or GPAC-linked binaries during scene graph processing.
Presence of GPAC installations at commits at or before f1219cde on production or analyst workstations.
Media processing jobs that fail on specific attacker-supplied inputs targeting the gf_node_changed_internal code path.

Detection Strategies

Inventory endpoints and build systems for GPAC binaries and verify installed versions against release abi-16.23.
Enable AddressSanitizer (ASAN) or similar memory error detectors in test environments that ingest untrusted media to surface use-after-free events.
Monitor process telemetry for MP4Box invocations spawned by browsers, mail clients, or automated conversion services.

Monitoring Recommendations

Alert on abnormal termination of media processing daemons that invoke GPAC libraries.
Log file provenance for scene description and MP4 files processed in server-side pipelines to enable retrospective analysis.
Correlate crash telemetry with the GitHub Issue #3800 reproducer characteristics.

How to Mitigate CVE-2026-90687

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems that process untrusted media.
Rebuild any downstream applications that statically link GPAC after applying the patched sources.
Restrict MP4Box execution to trusted inputs until patching is complete.

Patch Information

The fix is delivered in upstream commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24 and included in release abi-16.23. Distributions packaging GPAC should backport the commit if they cannot ship the full release. Refer to the VulDB CVE-2026-90687 record for tracking metadata.

Workarounds

Avoid processing untrusted scene description files with vulnerable MP4Box builds.
Sandbox media conversion workflows using seccomp, containers, or dedicated low-privilege service accounts.
Disable or remove MP4Box on systems where it is not required.

bash

# Verify installed GPAC version and upgrade from source
MP4Box -version
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make && sudo make install