CVE-2026-90826: GPAC MP4Box Buffer Overflow Vulnerability

CVE-2026-90826 Overview

CVE-2026-90826 is an out-of-bounds read vulnerability in GPAC 26.07.0, an open-source multimedia framework. The flaw resides in the gf_node_del function within scenegraph/base_scenegraph.c, a component invoked by the MP4Box utility. Processing a crafted media file triggers a memory read outside the intended buffer boundary, categorized as [CWE-119]. Exploitation requires local access and user interaction, limiting practical attack surface. A public proof-of-concept exists, and the maintainers have released a patch in version abi-16.23.

Critical Impact
Local attackers who convince a user to process a malicious media file with MP4Box can trigger an out-of-bounds read, resulting in limited information disclosure or process crash.

Affected Products

GPAC 26.07.0
MP4Box command-line utility
Applications linking against the vulnerable libgpac scenegraph component

Discovery Timeline

2026-09-14 - CVE-2026-90826 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90826

Vulnerability Analysis

The vulnerability affects the gf_node_del function in src/scenegraph/base_scenegraph.c, which handles node deletion in GPAC's scene graph structure. When MP4Box parses a specially crafted input file, the deletion routine reads memory outside the allocated bounds of the target buffer. The exploit was publicly disclosed with a proof-of-concept archive (poc_19_nstatx.zip) attached to GitHub Issue #3812. The EPSS score is 0.155% (percentile 5.041), reflecting a low predicted exploitation probability.

Root Cause

The defect stems from insufficient validation of buffer boundaries during scenegraph node teardown. Related patches in the same commit also address boundary and allocation issues in src/filters/reframe_mpgvid.c and src/laser/lsr_dec.c, indicating a broader hardening effort against fuzzer-discovered memory safety issues in media parsing paths.

Attack Vector

Exploitation requires local execution and user interaction: a user must invoke MP4Box or an application using libgpac against a malicious file. The impact is limited to availability degradation and potential adjacent-memory disclosure. Remote exploitation is not applicable.

// Patch excerpt from src/filters/reframe_mpgvid.c
// Replaces unchecked assertions with defensive bounds validation
if (ftype) {
-    gf_assert(pck_data[0] == 0);
-    gf_assert(pck_data[1] == 0);
-    gf_assert(pck_data[2] == 1);
+    if (size < 3 || pck_data[0] != 0 || pck_data[1] != 0 || pck_data[2] != 1) {
+        gf_filter_pid_drop_packet(ctx->ipid);
+        gf_filter_pck_discard(dst_pck);
+        return GF_BAD_PARAM;
+    }

    gf_filter_pck_set_framing(dst_pck, GF_TRUE, (full_frame || ctx->input_is_au_end) ? GF_TRUE : GF_FALSE);
    gf_filter_pck_set_cts(dst_pck, ctx->cts);
}
// Source: [GitHub Commit afca1f1](https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975)

Detection Methods for CVE-2026-90826

Indicators of Compromise

Unexpected termination or segmentation faults of MP4Box or libgpac-backed processes during media file processing.
Presence of untrusted media files matching the public PoC archive poc_19_nstatx.zip structure.
Core dumps referencing gf_node_del in scenegraph/base_scenegraph.c.

Detection Strategies

Inventory endpoints and build systems for GPAC installations at or below version 26.07.0 using software composition analysis.
Monitor process telemetry for MP4Box invocations against files sourced from untrusted locations such as downloads or email attachments.
Enable AddressSanitizer or similar runtime instrumentation in development and CI pipelines that ingest media samples.

Monitoring Recommendations

Alert on abnormal exit codes or crash signals from MP4Box and dependent multimedia processing pipelines.
Log the file paths and hashes of media inputs processed by libgpac for retrospective triage.
Track new issues filed against the GPAC repository for related scenegraph parsing defects.

How to Mitigate CVE-2026-90826

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems running MP4Box or linking libgpac.
Restrict MP4Box execution to trusted media inputs only, particularly in shared build agents and rendering farms.
Remove or quarantine any copies of the public PoC file poc_19_nstatx.zip from user-accessible storage.

Patch Information

The fix is delivered in commit afca1f1181668d85941d51ed1adf647807d5d975 and shipped in release abi-16.23. The commit adds bounds checks in reframe_mpgvid.c, replaces unsafe allocation in lsr_dec.c with GF_SAFEALLOC, and hardens node deletion paths in the scenegraph component. Distribution maintainers should pull the referenced release tag when repackaging GPAC.

Workarounds

Avoid processing untrusted or unsolicited multimedia files with MP4Box until the upgrade is applied.
Run MP4Box in a sandbox or unprivileged container to contain any memory disclosure to an isolated environment.
Disable scene graph-dependent features in downstream applications that embed libgpac when patching is not immediately possible.

bash

# Upgrade GPAC from source to the fixed release
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc)
sudo make install

# Verify the installed version
MP4Box -version