CVE-2026-90611: GPAC MP4Box loader_xmt.c xmt_parse_element assertion
A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmtparseelement of the file scenemanager/loaderxmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 will fix this issue. This patch is called afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC (MP4Box) MP4Box/scene_manager/loader_xmt.cto a version that resolves this vulnerability.Fixed in abi-16.23Patch afca1f1181668d85941d51ed1adf647807d5d975
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation is restricted to local execution and requires low privileges. An attacker would need the ability to run or invoke MP4Box locally with manipulated input.
What is the impact of successful exploitation?
The manipulation can trigger a reachable assertion in xmt_parse_element, resulting in an availability impact. The provided metrics indicate no confidentiality or integrity impact.
Which versions should be remediated?
GPAC versions up to f1219cde are affected. Upgrade to abi-16.23, which includes patch afca1f1181668d85941d51ed1adf647807d5d975.
Is exploitation theoretical?
No. A public exploit disclosure exists, and the exploit may be used.