CVE-2026-90825: GPAC MP4Box Use After Free Vulnerability

CVE-2026-90825 Overview

CVE-2026-90825 is a use-after-free vulnerability [CWE-119] in GPAC 26.07.0, an open-source multimedia framework used for packaging, streaming, and processing MPEG-4 content. The flaw resides in the gf_node_unregister function within scenegraph/base_scenegraph.c, reachable through the MP4Box component. An attacker with local access can trigger the condition by supplying a crafted input, causing GPAC to reuse memory after it has been freed. A public proof-of-concept exists. The GPAC project addressed the issue in release abi-16.23 with commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24.

Critical Impact
Local exploitation can crash the MP4Box process and, depending on heap state, enable memory corruption that may lead to arbitrary code execution in the context of the user running the tool.

Affected Products

GPAC 26.07.0
GPAC MP4Box component (scenegraph subsystem)
Downstream distributions bundling GPAC 26.07.0 prior to abi-16.23

Discovery Timeline

2026-09-14 - CVE-2026-90825 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90825

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-119] in GPAC's scene graph handling. When MP4Box parses a malformed scene description, an error path invokes gf_node_unregister on a node that is still referenced elsewhere in the parser's internal state, specifically the def_nodes list. Subsequent access to that stale reference dereferences freed memory. Exploitation requires local access and low privileges, and no user interaction beyond invoking the vulnerable tool on attacker-controlled input.

Root Cause

The error-handling path in src/scene_manager/loader_bt.c unregistered a node without first removing it from parser->def_nodes. The parser continued to hold a dangling pointer, allowing later code paths to operate on freed heap memory. A related fix in src/laser/lsr_dec.c addressed a labeled-statement declaration issue in the SVG_ViewBox_datatype case that contributed to the buggy control flow after the fuzz-related rework tracked in commit afca1f1.

Attack Vector

An attacker delivers a crafted multimedia file to a local user who processes it with MP4Box. Parsing the file triggers the error path in the scene loader, freeing a node while the parser retains a reference. Any subsequent operation on that reference reads or writes freed memory, yielding a crash or, with heap grooming, controlled memory corruption.

// Patch excerpt from src/scene_manager/loader_bt.c
 	return node;
 
 err:
+	gf_list_del_item(parser->def_nodes, node);
 	gf_node_unregister(node, parent);
 	if (name) gf_free(name);
 	return NULL;
// Source: https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24

The added gf_list_del_item call removes the node from the parser's tracked definitions before gf_node_unregister frees it, preventing the dangling reference.

Detection Methods for CVE-2026-90825

Indicators of Compromise

Unexpected crashes or segmentation faults in MP4Box processes when parsing untrusted media files.
Core dumps referencing gf_node_unregister or base_scenegraph.c in the stack trace.
Presence of GPAC binaries at version 26.07.0 without the abi-16.23 update on user workstations or build servers.

Detection Strategies

Inventory installed GPAC packages and flag hosts running 26.07.0 or earlier without the patch commit 9eb40df.
Run AddressSanitizer or Valgrind against GPAC in test environments to confirm use-after-free triggers on suspicious inputs.
Monitor for MP4Box invocations against files from untrusted sources such as email attachments, download folders, or shared network drives.

Monitoring Recommendations

Enable endpoint telemetry to capture process launches of MP4Box, gpac, and MP4Client along with their command-line arguments.
Alert on repeated MP4Box crashes on the same host, which may indicate exploitation attempts or fuzzing activity.
Log file provenance for media assets processed by automated pipelines to trace malicious inputs.

How to Mitigate CVE-2026-90825

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems running the framework.
Restrict use of MP4Box to trusted input sources until the patch is applied.
Remove or disable GPAC on hosts where the tool is not required, particularly on multi-user systems.

Patch Information

The fix is contained in commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24 and shipped in the abi-16.23 release. Additional context is available in GPAC Issue #3805 and the VulDB entry for CVE-2026-90825.

Workarounds

Process untrusted media files inside sandboxed containers or virtual machines with no access to sensitive data.
Run MP4Box under a low-privilege service account that cannot write to system directories or user profiles.
Apply mandatory access controls such as AppArmor or SELinux profiles to constrain the GPAC binaries.

bash

# Build and install the patched GPAC release from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure
make -j"$(nproc)"
sudo make install
MP4Box -version