CVE-2026-90824: GPAC MP4Box Buffer Overflow Vulnerability

CVE-2026-90824 Overview

CVE-2026-90824 is a stack-based buffer overflow in GPAC 26.07.0, an open-source multimedia framework. The flaw resides in the gf_sg_dom_event_bubble function within src/scenegraph/dom_events.c, part of the MP4Box component. An attacker with local access and low privileges can trigger memory corruption by supplying a crafted input to MP4Box. The issue is tracked under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). A public proof-of-concept has been disclosed, and the project has issued a fix in release abi-16.23 through commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24.

Critical Impact
Local exploitation can corrupt the process stack in MP4Box, leading to application crashes and potential memory disclosure or manipulation during multimedia file processing.

Affected Products

GPAC 26.07.0
MP4Box component (src/scenegraph/dom_events.c)
Downstream distributions bundling GPAC prior to release abi-16.23

Discovery Timeline

2026-09-14 - CVE-2026-90824 published to NVD
2026-09-15 - Last updated in NVD database
Patch commit - 9eb40df4448b88d6a6ce3454657c06f47eff0b24 merged into GPAC repository
Fixed release - GPAC abi-16.23

Technical Details for CVE-2026-90824

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow inside gf_sg_dom_event_bubble, a DOM event propagation routine used by the GPAC scene graph. MP4Box invokes this function while processing scene events tied to SVG, LASeR, and BIFS content embedded in multimedia containers. When a specifically crafted file is parsed, the event bubbling logic writes beyond the bounds of a fixed-size stack buffer. The overflow can corrupt saved return addresses, frame pointers, or adjacent local variables within the MP4Box process. Because MP4Box is a command-line utility, exploitation requires the victim to process an attacker-supplied file locally.

Root Cause

The root cause is insufficient bounds enforcement during DOM event propagation in src/scenegraph/dom_events.c. Related fixes in the same commit also strengthen list bookkeeping in the scene loader and correct a control-flow issue in the LASeR decoder, indicating that node lifecycle and structure handling across the scene graph were the source of memory-safety regressions.

Attack Vector

Exploitation requires local access with low privileges. An attacker delivers a crafted multimedia file that a user or automated pipeline processes with MP4Box. There is no network attack path, and no user interaction beyond invoking MP4Box on the malicious input is required. Impact is limited to availability, with potential for further exploitation depending on stack layout and compiler mitigations in the target build.

// Patch excerpt from src/laser/lsr_dec.c (release abi-16.23)
// Adds a statement after the case label so the following declaration is valid,
// preventing a build/parse error tied to the fuzz-hardening changes.
 		}
 		return da;
 	}
-	case SVG_ViewBox_datatype:
+	case SVG_ViewBox_datatype:;
 		SVG_ViewBox *viewbox;
 		GF_SAFEALLOC(viewbox, SVG_ViewBox)
 		return viewbox;

Source: GitHub Commit 9eb40df

// Patch excerpt from src/scene_manager/loader_bt.c (release abi-16.23)
// On the error path, the partially constructed node is removed from
// parser->def_nodes before unregister, avoiding dangling references that
// contributed to memory-safety regressions in the scene graph.
 	return node;
 
 err:
+	gf_list_del_item(parser->def_nodes, node);
 	gf_node_unregister(node, parent);
 	if (name) gf_free(name);
 	return NULL;

Source: GitHub Commit 9eb40df

Detection Methods for CVE-2026-90824

Indicators of Compromise

Unexpected crashes or segmentation faults from MP4Box processes when parsing untrusted multimedia files.
Presence of GPAC binaries with version strings prior to abi-16.23 on production or build systems.
Files matching the disclosed proof-of-concept archive poc_08_add.zip referenced in GitHub Issue #3804.

Detection Strategies

Inventory installed GPAC packages and compare versions against the fixed release abi-16.23.
Monitor process telemetry for MP4Box invocations paired with abnormal exit codes or core dumps.
Scan software bills of materials (SBOMs) for third-party products that embed vulnerable GPAC libraries.

Monitoring Recommendations

Enable core dump collection on hosts that run MP4Box in batch or transcoding pipelines.
Alert on new writable files landing in directories consumed by MP4Box workflows.
Track execution of MP4Box under privileged or service accounts and review parent process lineage.

How to Mitigate CVE-2026-90824

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems that run MP4Box.
Restrict MP4Box execution to trusted users and avoid processing untrusted multimedia files.
Rebuild downstream products that statically link GPAC against the patched source tree.

Patch Information

The issue is resolved by commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24 and shipped in GPAC release abi-16.23. Details are available in the GitHub Commit 9eb40df, the GitHub Release abi-16.23, and the tracking GitHub Issue #3804. Additional metadata is published on VulDB CVE-2026-90824.

Workarounds

Do not invoke MP4Box on files received from untrusted sources until the patch is applied.
Sandbox MP4Box execution with tools such as firejail, bubblewrap, or containers with seccomp profiles.
Compile GPAC with stack protectors (-fstack-protector-strong) and full RELRO to reduce exploit reliability.

bash

# Verify the installed GPAC version and upgrade to the fixed release
MP4Box -version 2>&1 | head -n 2

# Build the patched release from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure --static-mp4box
make -j"$(nproc)"
sudo make install