CVE-2026-90794

GPAC MP4Box vrml_tools.c gf_sg_script_load use after free

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component.

Analysis

AI-generated

Technical impact

The flaw is a use‑after‑free bug in the gf_sg_script_load function located in scenegraph/vrml_tools.c of GPAC’s MP4Box component. After a script is loaded and the memory that holds it is freed, the function can still reference that memory, allowing an attacker to execute arbitrary code or crash the application. The weakness is a typical buffer overflow and memory corruption scenario (CWE‑119 and CWE‑416). The vulnerability is remotely exploitable, and a public exploit is available.

Affected Systems

GPAC, the open‑source multimedia framework that includes the MP4Box command‑line tool. Versions up to the Git commit f1219cde are vulnerable. The advised fix is to upgrade to version abi‑16.23 or later, which incorporates the patch from commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity risk. No EPSS score is published, and the flaw is not listed in the CISA KEV catalog. Because the attack requires only a remotely triggered manipulation of a script, the practical exploitation is realistic, especially since a proof‑of‑concept and public exploit code have already been released.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GPAC to version abi‑16.23 or later to apply the official patch that fixes the use‑after‑free in gf_sg_script_load.
  • If an immediate upgrade is not possible, restrict MP4Box’s exposure to untrusted input by disabling remote script loading or isolating the component to a locked environment.
  • Continuously monitor logs and crash reports for forced memory accesses or abnormal terminations that could indicate exploitation attempts, and defer the upgrade until it can be applied.

Generated by OpenCVE AI on September 15, 2026 at 13:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. It is possible to initiate the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is sufficient to fix this issue. The patch is named 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is advisable to upgrade the affected component.
Title GPAC MP4Box vrml_tools.c gf_sg_script_load use after free
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-416
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 4:28 PM
Reserved
Sep 13, 2026, 1:37 PM

View source JSON

Updated
Sep 14, 2026, 4:28 PM

JSON

Status
Deferred
Published
Sep 14, 2026, 4:17 PM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 1:30 PM

JSON