CVE-2026-90683: GPAC MP4Box base_scenegraph.c gf_node_unregister assertion
A vulnerability was detected in GPAC up to f1219cde. Affected is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to address this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component. This is not a duplicate of CVE-2021-46237 or CVE-2021-46234.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Boxto a version that resolves this vulnerability.Fixed in abi-16.23Patch 49dee5cad329cfed310c1682703df7daa47df31a - Compensating control
Given local attack requirement and assertion-based crash, restrict local access to MP4Box/GPAC execution (e.g., limit who can run MP4Box and prevent untrusted local users from providing crafted inputs).
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Exploitation requires local access and low privileges. The described impact is a reachable assertion that can affect availability, with no confidentiality or integrity impact indicated.
Which versions should be remediated?
GPAC versions up to commit f1219cde are affected. Upgrade the MP4Box component to version abi-16.23, which addresses the issue; the referenced patch is 49dee5cad329cfed310c1682703df7daa47df31a.
How urgent is remediation?
The issue is rated low severity with a 3.3 score, but public exploit availability is reported. Prioritize systems where untrusted local users can manipulate MP4Box inputs or execution conditions.