CVE-2026-90824: GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow
A vulnerability has been found in GPAC 26.07.0. Affected is the function gfsgdomeventbubble of the file src/scenegraph/domevents.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Box (src/scenegraph/dom_events.c: gf_sg_dom_event_bubble)to a version that resolves this vulnerability.Fixed in abi-16.23Patch 9eb40df4448b88d6a6ce3454657c06f47eff0b24 - Compensating control
Since the attack can only be performed from a local environment, restrict local access to the affected system/process (e.g., limit who can execute/submit MP4Box/GPAC locally) to reduce exposure to exploitation.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Exposure is limited to local environments. Exploitation requires local access and low privileges; no user interaction is required.
Which versions should be remediated?
GPAC 26.07.0 is identified as affected. Upgrading the affected component to version abi-16.23 addresses the issue.
What should be done if an upgrade cannot be performed immediately?
Restrict local access to systems running the affected MP4Box component, since the attack can only be performed locally. The supplied data does not identify another mitigation.
Is exploit code available?
Yes. The exploit has been publicly disclosed and may be used.
How can the remediation patch be identified?
The patch identifier is 9eb40df4448b88d6a6ce3454657c06f47eff0b24.