CVE-2026-90791: GPAC MP4Box Use-After-Free Vulnerability

CVE-2026-90791 Overview

CVE-2026-90791 is a use-after-free vulnerability [CWE-119] in the GPAC multimedia framework, affecting builds up to commit f1219cde. The flaw resides in the gf_node_unregister function within scenegraph/base_scenegraph.c, reachable through the MP4Box component when processing crafted scene descriptions. An attacker can trigger memory reuse after a node has been freed, leading to undefined behavior during scene parsing. A public exploit exists, and the issue is resolved in release abi-16.23.

Critical Impact
Successful exploitation can corrupt heap state during MP4Box processing of malicious scene files, enabling limited confidentiality, integrity, and availability impact. User interaction is required to open a crafted file.

Affected Products

GPAC multimedia framework builds up to commit f1219cde
GPAC MP4Box command-line utility
GPAC scene graph and BT loader components (scenegraph/base_scenegraph.c, scene_manager/loader_bt.c, laser/lsr_dec.c)

Discovery Timeline

2026-09-14 - CVE-2026-90791 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database
Patch commit - 9eb40df4448b88d6a6ce3454657c06f47eff0b24 merged into the GPAC repository
Fixed release - abi-16.23 published on the GPAC GitHub releases page

Technical Details for CVE-2026-90791

Vulnerability Analysis

The vulnerability is a use-after-free in GPAC's scene graph subsystem. When MP4Box parses a malformed scene description, error handling in the BT loader calls gf_node_unregister on a node that remains referenced by the parser's def_nodes list. Subsequent access to the stale pointer produces heap corruption. The bug is reachable when a user opens or processes an attacker-supplied file with an affected MP4Box build. Because MP4Box is frequently invoked in automated media pipelines, the flaw can also surface in server-side transcoding workflows that ingest untrusted inputs.

Root Cause

The root cause is a missing list cleanup before node deallocation. In the failure path of the BT loader, the freed node was not removed from parser->def_nodes before gf_node_unregister released its memory. Later scene graph traversal dereferenced the dangling pointer, satisfying the classic use-after-free pattern classified under [CWE-119].

Attack Vector

Exploitation requires an attacker to deliver a crafted scene description file that a victim processes with a vulnerable MP4Box build. The attack executes over the network in the sense that the malicious payload can be distributed remotely, but user interaction is required to trigger parsing. Refer to the public GitHub CVE Submission Document and GitHub Issue #3801 for reproducer details.

// Patch excerpt: src/scene_manager/loader_bt.c
 	return node;
 
 err:
+	gf_list_del_item(parser->def_nodes, node);
 	gf_node_unregister(node, parent);
 	if (name) gf_free(name);
 	return NULL;
// Source: https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24

The fix removes the node from parser->def_nodes before calling gf_node_unregister, eliminating the dangling reference. A companion adjustment in src/laser/lsr_dec.c corrects a related declaration-after-label build issue introduced in a prior commit.

Detection Methods for CVE-2026-90791

Indicators of Compromise

Unexpected MP4Box process crashes or SIGSEGV events during scene or BT file parsing
Heap corruption warnings from AddressSanitizer or Valgrind when processing untrusted media files
Presence of GPAC binaries built from commits at or before f1219cde

Detection Strategies

Inventory hosts and build pipelines for GPAC versions predating release abi-16.23
Monitor for MP4Box invocations that consume files from untrusted sources such as user uploads or email attachments
Correlate media processing jobs that terminate abnormally with the source file to identify potential exploitation attempts

Monitoring Recommendations

Log command-line arguments and exit codes for MP4Box in transcoding and media ingestion services
Alert on repeated crashes of GPAC utilities against files originating from the same tenant or upload path
Ingest process telemetry into a centralized analytics platform to baseline normal MP4Box behavior and surface anomalies

How to Mitigate CVE-2026-90791

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later using the GPAC GitHub repository
Rebuild any downstream tooling or containers that statically link GPAC libraries
Restrict MP4Box execution to trusted media inputs until the patch is deployed

Patch Information

The fix is delivered in upstream commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24 and released as abi-16.23. Review the GitHub Commit 9eb40df for the exact changes and the VulDB CVE-2026-90791 entry for advisory metadata.

Workarounds

Run MP4Box inside a sandbox or non-privileged container that restricts filesystem and network access
Reject or quarantine scene description files from untrusted origins prior to invoking GPAC utilities
Disable automated MP4Box processing in ingestion pipelines until the upgrade is validated

bash

# Build and install the fixed GPAC release
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure
make -j$(nproc)
sudo make install
MP4Box -version