CVE-2026-90612: GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion
A vulnerability was identified in GPAC up to f1219cde. Affected is the function gfsmdumpcommandlist of the file scenemanager/scenedump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Box (scene_manager/scene_dump.c gf_sm_dump_command_list)to a version that resolves this vulnerability.Fixed in abi-16.23Patch afca1f1181668d85941d51ed1adf647807d5d975
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the MP4Box component of GPAC at or before f1219cde are affected. Exploitation requires local access and low privileges.
What impact can exploitation have?
The issue can trigger a reachable assertion in gf_sm_dump_command_list, resulting in a low-severity availability impact. The provided vector indicates no confidentiality or integrity impact.
Is public exploit code available?
Yes. The exploit is publicly available and might be used.
What is the recommended remediation?
Upgrade the affected GPAC component to version abi-16.23. The associated patch identifier is afca1f1181668d85941d51ed1adf647807d5d975.