CVE-2026-90793: GPAC MP4Box Use After Free Vulnerability

CVE-2026-90793 Overview

CVE-2026-90793 is a use-after-free vulnerability in GPAC, an open-source multimedia framework. The flaw resides in the gf_node_get_name function within scenegraph/base_scenegraph.c, part of the MP4Box component. Attackers can trigger the condition remotely by supplying a crafted input that GPAC parses, though user interaction is required to process the file. The issue affects GPAC versions up to commit f1219cde and has been publicly disclosed. Upstream maintainers addressed the flaw in release abi-16.23 via commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The vulnerability is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Successful exploitation can corrupt process memory in MP4Box, potentially leading to limited integrity and availability impact on the parsing process.

Affected Products

GPAC multimedia framework up to commit f1219cde
MP4Box command-line utility shipped with GPAC
GPAC releases prior to abi-16.23

Discovery Timeline

2026-09-14 - CVE-2026-90793 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90793

Vulnerability Analysis

The vulnerability is a use-after-free (UAF) in gf_node_get_name, located in src/scenegraph/base_scenegraph.c. When MP4Box parses a scene graph node whose backing memory has already been released, the function dereferences the freed pointer to read the node name. This produces undefined behavior that an attacker can steer by controlling heap layout through malformed multimedia input.

Exploitation requires a user to open or process a crafted file with a vulnerable MP4Box build. The scope is limited to the parsing process, and the CWE-119 classification reflects out-of-bounds memory access rather than remote code execution primitives. Public disclosure references are available in GitHub Issue #3803 and the VulDB entry.

Root Cause

The root cause is inconsistent lifetime management between scene graph nodes and their references. Upstream error-handling paths failed to remove a node from the parser's def_nodes list before calling gf_node_unregister, leaving a dangling reference that gf_node_get_name could later dereference. The fix explicitly removes the freed node from the tracking list.

Attack Vector

An attacker delivers a crafted multimedia file to a user or automated pipeline that invokes MP4Box. Parsing the file triggers the freed-node reference and corrupts memory in the utility's address space. The current EPSS score is 0.331%, indicating limited observed exploitation likelihood.

// Patch excerpt: src/scene_manager/loader_bt.c
 	return node;
 
 err:
+	gf_list_del_item(parser->def_nodes, node);
 	gf_node_unregister(node, parent);
 	if (name) gf_free(name);
 	return NULL;
// Source: https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24

The patch removes the node from parser->def_nodes before unregistering it, eliminating the dangling reference that gf_node_get_name would later follow. A companion fix in src/laser/lsr_dec.c adjusts a switch case declaration to correct related build and control-flow issues introduced in earlier commits.

Detection Methods for CVE-2026-90793

Indicators of Compromise

Unexpected crashes, aborts, or SIGSEGV events from MP4Box when parsing untrusted media files.
AddressSanitizer or Valgrind reports flagging heap-use-after-free in gf_node_get_name or loader_bt.c paths.
Presence of GPAC binaries built from commits at or before f1219cde in production or developer workstations.

Detection Strategies

Inventory installed GPAC versions and compare against release abi-16.23 or later.
Enable process crash telemetry and core-dump collection for media processing hosts to catch UAF-driven faults.
Run fuzzing or regression tests using the reproducer described in GitHub Issue #3803.

Monitoring Recommendations

Monitor endpoints and build pipelines that invoke MP4Box for anomalous exit codes or segmentation faults.
Alert on execution of MP4Box against files sourced from external or untrusted locations.
Track file transfers of MP4, BT, and SVG scene files into environments that automatically process them.

How to Mitigate CVE-2026-90793

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems.
Restrict MP4Box usage to trusted input sources until patched binaries are deployed.
Rebuild any downstream tools or containers that statically link vulnerable GPAC libraries.

Patch Information

The upstream fix is committed as 9eb40df4448b88d6a6ce3454657c06f47eff0b24 and shipped in release abi-16.23. The commit adjusts scene loader error handling to remove nodes from parser tracking lists before unregistration. Additional context is available in the CVE submission document.

Workarounds

Avoid processing untrusted scene graph or multimedia files with vulnerable MP4Box versions.
Sandbox MP4Box executions using tools such as firejail, bubblewrap, or container runtimes with restricted filesystem access.
Disable automated media ingestion workflows that call MP4Box until the upgrade is complete.

bash

# Verify installed version and upgrade from source
MP4Box -version
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc)
sudo make install
MP4Box -version