CVE-2026-90827: GPAC MP4Box Use After Free Vulnerability

CVE-2026-90827 Overview

CVE-2026-90827 is a use-after-free vulnerability in GPAC 26.07.0, an open-source multimedia framework. The flaw resides in the gf_node_deactivate_ex function within scenegraph/base_scenegraph.c, reachable through the MP4Box component. An attacker with local access and low privileges can trigger the freed-memory dereference by supplying a crafted input to the vulnerable code path. A public proof-of-concept exists, increasing the likelihood of opportunistic exploitation. The upstream project addressed the issue in release abi-16.23 through commit 49dee5cad329cfed310c1682703df7daa47df31a. The vulnerability is classified under [CWE-119] (improper restriction of operations within the bounds of a memory buffer).

Critical Impact
Local exploitation can corrupt process memory in MP4Box, potentially leading to crashes or limited availability impact when parsing untrusted media inputs.

Affected Products

GPAC 26.07.0
GPAC MP4Box utility (component)
GPAC releases prior to abi-16.23

Discovery Timeline

2026-09-14 - CVE-2026-90827 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90827

Vulnerability Analysis

The vulnerability is a use-after-free condition in GPAC's scene graph handling code. The function gf_node_deactivate_ex in src/scenegraph/base_scenegraph.c operates on a scene graph node whose backing memory has already been released. When MP4Box processes a crafted media file, the code path reaches the deactivation routine and dereferences a stale pointer. Subsequent operations on that pointer produce undefined behavior, typically a process crash or memory corruption. Because MP4Box is commonly invoked in local media processing pipelines, the attack surface includes any workflow that parses untrusted MP4 or ISOBMFF-like content with a vulnerable GPAC build.

Root Cause

The root cause is missing lifetime management for scene graph node references. Command structures retained direct pointers to nodes without going through the reference-tracked setter, so nodes could be freed while still referenced from a pending command. The patch replaces the direct assignment with gf_sg_command_set_node, which properly registers and reference-counts the node.

Attack Vector

Exploitation requires local access with low privileges. The attacker supplies a malformed media file to MP4Box, which triggers the vulnerable deactivation path during parsing. No user interaction beyond invoking the tool on the crafted file is required. Network exploitation is not applicable.

// Patch excerpt: src/bifs/memory_decoder.c
 static void BM_SetCommandNode(GF_Command *com, GF_Node *node)
 {
-	com->node = node;
+	gf_sg_command_set_node(com, node);
 	gf_node_register(node, NULL);
 }

Source: GitHub Commit 49dee5c

A second hunk in the same commit fixes a related packet reference leak in the AV1 reframer, unreferencing ctx->src_pck during filter teardown:

// Patch excerpt: src/filters/reframe_av1.c
 	GF_AV1DmxCtx *ctx = gf_filter_get_udta(filter);
 	if (ctx->bs) gf_bs_del(ctx->bs);
 	if (ctx->indexes) gf_free(ctx->indexes);
+	if (ctx->src_pck) gf_filter_pck_unref(ctx->src_pck);
 
 	gf_av1_reset_state(&ctx->state, GF_TRUE);
 	if (ctx->state.config) gf_odf_av1_cfg_del(ctx->state.config);

Source: GitHub Commit 49dee5c

Detection Methods for CVE-2026-90827

Indicators of Compromise

Unexpected crashes or segmentation faults in the MP4Box process during media parsing.
Presence of the public proof-of-concept archive poc_20_nstatx.zip or derivative crafted inputs in user-writable directories.
Core dumps referencing gf_node_deactivate_ex or base_scenegraph.c frames.

Detection Strategies

Inventory hosts running GPAC and compare installed versions against release abi-16.23.
Monitor process creation events for MP4Box invocations on files sourced from untrusted locations.
Enable AddressSanitizer or similar runtime memory checkers in QA builds to catch use-after-free conditions during media ingestion tests.

Monitoring Recommendations

Log and alert on abnormal termination of media processing utilities in build pipelines and content-conversion services.
Audit scheduled tasks and batch jobs that invoke MP4Box with externally sourced files.
Track file writes matching the published PoC filename patterns across shared storage.

How to Mitigate CVE-2026-90827

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems where MP4Box is installed.
Restrict execution of MP4Box to trusted operators and validated input sources until patching is complete.
Remove or quarantine untrusted media files pending analysis, especially those matching the published proof-of-concept.

Patch Information

The fix is included in commit 49dee5cad329cfed310c1682703df7daa47df31a and shipped in the GitHub Release abi-16.23. Additional context is available in GitHub Issue #3813 and the VulDB CVE-2026-90827 entry.

Workarounds

Avoid processing untrusted media inputs with vulnerable GPAC builds until the upgrade is applied.
Run MP4Box inside a sandbox or unprivileged container to limit the blast radius of a memory corruption event.
Apply mandatory access controls that prevent MP4Box from reading files outside a defined working directory.

bash

# Verify installed GPAC version and upgrade from source
MP4Box -version 2>&1 | head -n 2

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j"$(nproc)" && sudo make install