Executive brief
GPAC is a multimedia framework used for video streaming and transcoding. A heap buffer overflow in the scenegraph component (MP4Box) can be triggered through local file manipulation, potentially allowing an attacker with local access to crash the application or execute arbitrary code.
Technical details
The vulnerability is a heap-based buffer overflow in the gf_node_get_field function within scenegraph/base_scenegraph.c of the MP4Box component. It requires local access to trigger through file manipulation. The vulnerability allows heap memory corruption, which can lead to denial of service or arbitrary code execution. A patch is available in commit 49dee5cad329cfed310c1682703df7daa47df31a, with version abi-16.23 addressing the issue. The exploit is public.
Affected products
- GPAC GPAC up to f1219cde
Timeline
- 2026-09-13: disclosed: CVE-2026-90577 published
- 2026-07-28: patched: Patch commit 49dee5cad329cfed310c1682703df7daa47df31a merged; version abi-16.23 released