CVE-2026-90686: GPAC MP4Box loader_bt.c gf_bt_report memory corruption
A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC/MP4Boxto a version that resolves this vulnerability.Fixed in abi-16.23Patch afca1f1181668d85941d51ed1adf647807d5d975
Event History
Frequently Asked Questions
Which deployments are affected?
GPAC MP4Box deployments using versions up to commit f1219cde are affected. The issue is in the scene_manager/loader_bt.c component, specifically the gf_bt_report function.
Can this be exploited remotely without credentials or user interaction?
Yes. The supplied severity vector indicates network attack vector, low attack complexity, no privileges required, and no user interaction required; the description also states that remote exploitation is possible.
Is public exploit code available?
Yes. The exploit has been made public and could be used.
What is the recommended remediation?
Upgrade the affected GPAC MP4Box component to version abi-16.23. The identified patch is afca1f1181668d85941d51ed1adf647807d5d975.