CVE-2026-90684

GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Description
A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version abi-16.23 addresses this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Analysis

AI-generated

Technical impact

The flaw exists in the gf_node_get_field_count function of the GPAC attacker can craft input that causes the function to trigger an assertion failure, terminating the process. This results in a local denial of service because the program crashes and is an unchecked input handling flaw identified by CWE-617.

Affected Systems

Affected products are the GPAC software suite, specifically the MP4Box component, in all releases up to the commit identifier f1219cde. The security fix is available in version abi-16.23, which incorporates the patch identified by commit 49dee5cad329cfed310c1682703df7daa47df31a. Devices or systems running earlier versions are vulnerable.

Risk and Exploitability

The CVSS score of 2.4 indicates low severity. The EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA KEV. An attacker with local access can trigger the assertion by supplying crafted input to gf_node_get_field_count, causing a crash and local denial of service. No escalation or data compromise occurs.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GPAC to version abi-16.23 which includes the security fix
  • Apply the patch corresponding to commit 49dee5cad329cfed310c1682703df7daa47df31a if your installation cannot be upgraded directly
  • Restrict the execution of MP4Box to non‑privileged users and validate all input to limit potential denial of service impact

Generated by OpenCVE AI on September 15, 2026 at 15:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version abi-16.23 addresses this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
Title GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-617
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 2.8, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 2.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 2.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 3:47 PM
Reserved
Sep 13, 2026, 4:55 AM

View source JSON

Updated
Sep 14, 2026, 3:47 PM

JSON

Status
Deferred
Published
Sep 14, 2026, 5:16 AM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 3:30 PM

JSON