CVE-2026-90826: GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds
A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gfnodedel of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Box (scenegraph/base_scenegraph.c, function gf_node_del)to a version that resolves this vulnerability.Fixed in abi-16.23Patch afca1f1181668d85941d51ed1adf647807d5d975
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Exploitation is restricted to local execution and requires low privileges plus user interaction. It is therefore most relevant on systems where a local user can cause MP4Box to process attacker-controlled input.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What version should be deployed to remediate the issue?
Upgrade the affected GPAC MP4Box component to version abi-16.23. The referenced patch is afca1f1181668d85941d51ed1adf647807d5d975.