CVE-2026-90577

GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow

View on CVE.org
Published Sep 13, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version abi-16.23 addresses this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. The affected component should be upgraded.

Analysis

AI-generated

Technical impact

A local heap-based buffer overflow occurs inside the gf_node_get_field routine of GPAC's MP4Box component. The flaw is triggered by malicious input that causes the function to write beyond the bounds of a heap buffer, resulting in CWE-119 and CWE-122 and can lead to crashes or altered program behavior, although arbitrary code execution is not guaranteed by the description.

Affected Systems

GPAC releases up to commit f in scenegraph/base_scenegraph.c, are affected. All installations running a version earlier than abi-16.23 are susceptible. The official fix is delivered by the patch commit 49dee5cad329cfed310c1682703df7daa47df31a, incorporated in the abi-16.23 release.

Risk and Exploitability

The CVSS base score of 4.8 indicates a moderate severity. The EPSS score is less than 1%, showing that exploitation is unlikely. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local, with crafted input. Because the exploitation is possible only on systems that run the vulnerable component, the overall risk remains moderate but timely remediation is still recommended.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GPAC to version abi-16.23 or later, which includes the heap-overflow fix.
  • If an upgrade is not immediately possible, download and apply patch commit 49dee5cad329cfed310c1682703df7daa47df31a to the source code tree and rebuild MP4Box on systems that do not require media-processing capabilities to reduce the attack surface.
  • Limit local user privileges so that only trusted accounts can execute MP4Box with potentially untrusted input, thereby reducing the opportunity for a local attacker to exploit the vulnerability.

Generated by OpenCVE AI on September 15, 2026 at 17:11 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version abi-16.23 addresses this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. The affected component should be upgraded.
Title GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-122
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-122

    Heap-based Buffer Overflow

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 15, 2026, 1:59 PM
Reserved
Sep 12, 2026, 4:34 PM

View source JSON

Updated
Sep 15, 2026, 1:42 PM

JSON

Status
Deferred
Published
Sep 13, 2026, 7:16 PM
Modified
Sep 15, 2026, 3:17 PM

View source JSON

No data.

Updated
Sep 15, 2026, 5:15 PM

JSON