CVE-2026-90794: GPAC MP4Box vrml_tools.c gf_sg_script_load use after free
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gfsgscriptload of the file scenegraph/vrmltools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Box (scenegraph/vrml_tools.c, function gf_sg_script_load)to a version that resolves this vulnerability.Fixed in abi-16.23Patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24
Event History
Frequently Asked Questions
What versions are affected and what version fixes the issue?
GPAC MP4Box is affected up to commit f1219cde. Upgrading to version abi-16.23 fixes the vulnerability; the identified patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24.
What does an attacker need to exploit this vulnerability?
The issue can be initiated remotely through manipulation involving MP4Box's affected gf_sg_script_load function. User interaction is required according to the supplied severity vector, and no privileges are required.
Is public exploit information available?
Yes. The exploit has been made public and could be used.