CVE-2026-91090: GPAC Buffer Overflow Vulnerability

CVE-2026-91090 Overview

CVE-2026-91090 is a stack-based buffer overflow in GPAC, an open-source multimedia framework, affecting versions up to commit f1219cde. The flaw resides in the gf_node_activate_ex function within scenegraph/base_scenegraph.c. An attacker with local access and low privileges can trigger the overflow by supplying crafted scene graph input. The issue is classified under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer). A public proof-of-concept has been disclosed. GPAC has released version abi-16.23 containing patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24 to remediate the flaw.

Critical Impact
Local exploitation can corrupt stack memory in GPAC processes, potentially leading to denial of service or limited code execution against users who process malicious multimedia files.

Affected Products

GPAC multimedia framework up to commit f1219cde
GPAC scenegraph/base_scenegraph.c component (gf_node_activate_ex function)
Fixed in GPAC release abi-16.23

Discovery Timeline

2026-09-15 - CVE-2026-91090 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91090

Vulnerability Analysis

The vulnerability exists in the gf_node_activate_ex function of GPAC's scene graph subsystem. The function processes scene graph node activation but fails to enforce proper bounds when writing to a stack-allocated buffer. Processing a specially crafted input file causes the function to write beyond the allocated stack region. Public exploit material has been shared through VulDB and GitHub attachments, increasing the likelihood of opportunistic use against local users and automated pipelines that parse untrusted media.

Root Cause

The root cause is improper restriction of memory buffer operations [CWE-119] within scenegraph/base_scenegraph.c. Related fixes in the same patch address parsing routines in src/laser/lsr_dec.c and src/scene_manager/loader_bt.c, where node handling and viewbox datatype processing lacked correct cleanup and case-label scoping. Together these defects allow malformed scene graph data to corrupt the stack frame.

Attack Vector

Exploitation requires local access with low privileges and user interaction, such as opening or converting a malicious multimedia file through a GPAC tool. Remote or network-based attack paths are not applicable. The attacker delivers a crafted input file that reaches gf_node_activate_ex, triggering the overflow during scene graph activation.

// Patch excerpt: src/laser/lsr_dec.c
 		}
 		return da;
 	}
-	case SVG_ViewBox_datatype:
+	case SVG_ViewBox_datatype:;
 		SVG_ViewBox *viewbox;
 		GF_SAFEALLOC(viewbox, SVG_ViewBox)
 		return viewbox;
// Source: https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24

// Patch excerpt: src/scene_manager/loader_bt.c
 	return node;
 
 err:
+	gf_list_del_item(parser->def_nodes, node);
 	gf_node_unregister(node, parent);
 	if (name) gf_free(name);
 	return NULL;
// Source: https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24

The first hunk adds an empty statement after the case label so a subsequent variable declaration is syntactically valid. The second hunk removes a dangling node reference from the parser's def_nodes list on the error path, preventing subsequent use of freed or partially initialized scene graph nodes.

Detection Methods for CVE-2026-91090

Indicators of Compromise

Unexpected crashes or segmentation faults in GPAC binaries such as MP4Box or gpac when processing untrusted media files.
Presence of proof-of-concept artifacts matching the published PoC file nstatx.zip on hosts running GPAC.
Core dumps referencing gf_node_activate_ex or scenegraph/base_scenegraph.c in stack traces.

Detection Strategies

Inventory endpoints and build servers for GPAC installations below release abi-16.23 using software composition analysis.
Monitor process telemetry for GPAC-related binaries spawning shells, writing to unexpected paths, or terminating abnormally after opening media files.
Enable Address Sanitizer or compiler stack-protector diagnostics in test environments to surface overflows during media parsing.

Monitoring Recommendations

Alert on GPAC process crashes correlated with recent file-open events sourced from user downloads or email attachments.
Track file-write and network egress activity from user accounts that routinely process third-party multimedia files with GPAC.
Ingest host and application logs into a centralized data lake to correlate GPAC crash events with subsequent suspicious activity.

How to Mitigate CVE-2026-91090

Immediate Actions Required

Upgrade all GPAC installations to release abi-16.23 or later.
Apply commit 9eb40df directly in environments that build GPAC from source.
Restrict GPAC execution to trusted input sources until the patch is deployed across all hosts.

Patch Information

The GPAC project released patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24, included in tag abi-16.23. Full details are available in the GPAC commit and referenced GitHub Issue #3810.

Workarounds

Avoid opening untrusted or unsolicited multimedia files with GPAC utilities until patched.
Run GPAC command-line tools inside sandboxed or containerized environments with least privilege.
Disable or remove GPAC from systems that do not require multimedia framework functionality.

bash

# Verify installed GPAC version and upgrade from source
MP4Box -version

git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make -j$(nproc)
sudo make install