CVE-2026-90792: GPAC MP4Box RCE Vulnerability

CVE-2026-90792 Overview

CVE-2026-90792 is a null pointer dereference vulnerability in GPAC, an open-source multimedia framework, up to commit f1219cde. The flaw resides in the gf_node_list_get_child function within scenegraph/base_scenegraph.c, part of the MP4Box component. Manipulation of the Target argument triggers the dereference, causing the process to crash. The issue is classified under [CWE-404] (Improper Resource Shutdown or Release) and has a public exploit. Upgrading to version abi-16.23 addresses the flaw via patch afca1f1181668d85941d51ed1adf647807d5d975.

Critical Impact
Remote attackers can crash MP4Box or applications embedding GPAC by supplying a crafted scene graph input, resulting in denial of service against media processing workflows.

Affected Products

GPAC multimedia framework up to commit f1219cde
MP4Box command-line utility bundled with affected GPAC builds
Applications linking the vulnerable scenegraph/base_scenegraph.c code path

Discovery Timeline

2026-09-14 - CVE-2026-90792 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90792

Vulnerability Analysis

The vulnerability exists in gf_node_list_get_child, a helper that walks a linked list of scene graph child nodes within GPAC's base scenegraph implementation. When the Target argument is manipulated to reference an unexpected or unset node, the function dereferences a null pointer during traversal. This aborts the MP4Box process handling the input file. Because MP4Box is widely used in automated media pipelines, transcoders, and content ingestion workflows, a single malformed file can halt downstream processing. Exploitation requires user interaction to open or process the malicious media asset. See the GitHub CVE Submission Document and GPAC Issue #3802 for technical details.

Root Cause

The root cause is missing validation of the Target node pointer prior to list traversal in gf_node_list_get_child. The maintainers' broader mem-safety pass also replaced unchecked gf_assert calls and raw allocations elsewhere in the parser with defensive checks, indicating a pattern of missing input validation across fuzz-reachable code paths.

Attack Vector

An attacker delivers a crafted media file to a victim who processes it with MP4Box or a GPAC-linked application. The attack is remote in the sense that the file can be delivered over the network, but a user must invoke the processing tool on the file. Successful exploitation results in a process crash and denial of service; the CVSS 4.0 vector reports no confidentiality or integrity impact.

// Patch excerpt from src/filters/reframe_mpgvid.c
// Replaces unchecked gf_assert calls with defensive validation
		if (ftype) {
-			gf_assert(pck_data[0] == 0);
-			gf_assert(pck_data[1] == 0);
-			gf_assert(pck_data[2] == 1);
+			if (size < 3 || pck_data[0] != 0 || pck_data[1] != 0 || pck_data[2] != 1) {
+				gf_filter_pid_drop_packet(ctx->ipid);
+				gf_filter_pck_discard(dst_pck);
+				return GF_BAD_PARAM;
+			}

			gf_filter_pck_set_framing(dst_pck, GF_TRUE, (full_frame || ctx->input_is_au_end) ? GF_TRUE : GF_FALSE);
			gf_filter_pck_set_cts(dst_pck, ctx->cts);

Source: GPAC commit afca1f1

Detection Methods for CVE-2026-90792

Indicators of Compromise

Repeated segfaults or abnormal terminations of MP4Box or GPAC-linked worker processes when parsing user-submitted media
Core dump files referencing gf_node_list_get_child or base_scenegraph.c in the stack trace
Media ingestion queues stalling on specific input files that consistently crash the parser

Detection Strategies

Inventory hosts running GPAC or MP4Box and compare installed versions against release abi-16.23
Enable core dump collection on media processing servers and alert on crashes in GPAC binaries
Fuzz test media ingestion endpoints with malformed MP4 and scene graph inputs in a pre-production environment

Monitoring Recommendations

Monitor process exit codes and crash telemetry from batch media conversion jobs
Track file hashes of media assets that repeatedly cause MP4Box termination for triage
Log invocation arguments and source IP for network-delivered files processed by GPAC pipelines

How to Mitigate CVE-2026-90792

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later, which includes patch commit afca1f1181668d85941d51ed1adf647807d5d975
Restrict MP4Box processing of untrusted media to sandboxed or containerized workers with automatic restart
Validate and reject malformed inputs at ingestion boundaries before invoking GPAC utilities

Patch Information

The fix is available in the GPAC Release v16.23. Applied changes are documented in the GPAC commit afca1f1 and tracked in GPAC Issue #3802. Distributions repackaging GPAC should rebuild against the patched source tree.

Workarounds

Disable MP4Box processing of scene graph content types from untrusted sources until patched
Run GPAC binaries under a supervisor that isolates crashes from the parent workflow
Apply the upstream patch selectively to older builds if a full version upgrade is not feasible

bash

# Verify installed GPAC version and upgrade
MP4Box -version

# Build patched release from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make && sudo make install