CVE-2026-90824: GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow

Published Sep 14, 2026
·
Updated

A vulnerability has been found in GPAC 26.07.0. Affected is the function gfsgdomeventbubble of the file src/scenegraph/domevents.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.

Affected Software

1 affected component
Gpac MP4Box<=26.07.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade GPAC MP4Box (src/scenegraph/dom_events.c: gf_sg_dom_event_bubble) to a version that resolves this vulnerability.

    Fixed in abi-16.23Patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24
  2. Compensating control

    Since the attack can only be performed from a local environment, restrict local access to the affected system/process (e.g., limit who can execute/submit MP4Box/GPAC locally) to reduce exposure to exploitation.

Event History

Sep 14, 2026
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who is exposed to this issue?

Exposure is limited to local environments. Exploitation requires local access and low privileges; no user interaction is required.

2

Which versions should be remediated?

GPAC 26.07.0 is identified as affected. Upgrading the affected component to version abi-16.23 addresses the issue.

3

What should be done if an upgrade cannot be performed immediately?

Restrict local access to systems running the affected MP4Box component, since the attack can only be performed locally. The supplied data does not identify another mitigation.

4

Is exploit code available?

Yes. The exploit has been publicly disclosed and may be used.

5

How can the remediation patch be identified?

The patch identifier is 9eb40df4448b88d6a6ce3454657c06f47eff0b24.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203