CVE-2026-90577: GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow
A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfield of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version abi-16.23 addresses this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gpac/MP4Boxto a version that resolves this vulnerability.Fixed in abi-16.23Patch 49dee5cad329cfed310c1682703df7daa47df31a
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running the GPAC MP4Box component with versions up to f1219cde are affected. Exploitation requires local access and low privileges, so it is most relevant where untrusted or less-trusted local users can run or influence MP4Box processing.
What does an attacker need to exploit it?
An attacker needs local access and low privileges. No user interaction is required, and public exploit code is reported to be available.
What version fixes the vulnerability?
Upgrade the affected GPAC MP4Box component to version abi-16.23. The listed patch is 49dee5cad329cfed310c1682703df7daa47df31a.