Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-90577: GPAC MP4Box can be crashed by local buffer overflow

CVE-2026-90577 · published 1 month ago

Summary

The MP4Box tool in GPAC can be forced to overwrite memory when a local user manipulates a specific function. This could cause the program to stop working or behave unpredictably. Update GPAC to the latest version to fix the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	–	gpac	f1219cde
Ubuntu:Pro:14.04:LTS	canonical	gpac	All versions

Original advisory text

GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version abi-16.23 addresses this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. The affected component should be upgraded.

References

https://vuldb.com/cve/CVE-2026-90577 Vendor Advisory
https://vuldb.com/submit/913216 Vendor Advisory
https://github.com/gpac/gpac/ URL
https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a Patch
https://ubuntu.com/security/CVE-2026-90577 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-90577 Third Party Advisory
https://github.com/gpac/gpac/releases/tag/abi-16.23 Patch
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90577... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-90577 Vendor Advisory
https://vuldb.com/vuln/403162 Vendor Advisory
https://github.com/gpac/gpac/issues/3816 Third Party Advisory
https://vuldb.com/vuln/403162/cti Third Party Advisory
https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-Heap-Buffer-Ov... Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.9 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-122Heap-based Buffer Overflow

CWE-119Buffer Overflow

Timeline

Published13 Sep 2026

Updated3 Nov 2026

First seen13 Sep 2026

Sources

CVE-2026-90577 · NVD

CVE-2026-90577 · MITRE

UBUNTU-CVE-2026-90577 · OSV

CVE-2026-90577 · OSV

Track software like this

Free during beta