LOW
GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion
Published Sep 14, 2026
2.4
LOWCVSS 4.0
EPSS 0.16%
Description
A flaw has been found in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field_count of the file scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack on the local host. The exploit has been published and may be used. Upgrading to version abi-16.23 addresses this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
Affected products
-
- Version f1219cdeStatusaffectedConstraints-
- Version
-
- Version abi-16.23StatusunaffectedConstraints-
- Version
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (9)
- https://github.com/gpac/gpac/ product
- https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a patch
- https://github.com/gpac/gpac/issues/3824 issue-tracking
- https://github.com/gpac/gpac/releases/tag/abi-16.23 patch
- https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln%20GPAC%20MP4Box%20Assertion%20Failure%20assert(node).md exploit
- https://vuldb.com/cve/CVE-2026-90684 third-party-advisory
- https://vuldb.com/submit/914026 third-party-advisory
- https://vuldb.com/vuln/403217 vdb-entrytechnical-description
- https://vuldb.com/vuln/403217/cti signaturepermissions-required
| Link | Providers | Tags |
|---|---|---|
| https://github.com/gpac/gpac/ | product | |
| https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a | patch | |
| https://github.com/gpac/gpac/issues/3824 | issue-tracking | |
| https://github.com/gpac/gpac/releases/tag/abi-16.23 | patch | |
| https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln%20GPAC%20MP4Box%20Assertion%20Failure%20assert(node).md | exploit | |
| https://vuldb.com/cve/CVE-2026-90684 | third-party-advisory | |
| https://vuldb.com/submit/914026 | third-party-advisory | |
| https://vuldb.com/vuln/403217 | vdb-entrytechnical-description | |
| https://vuldb.com/vuln/403217/cti | signaturepermissions-required |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner VulDB
Published Sep 14, 2026
Updated Sep 14, 2026
Reserved Sep 13, 2026
Link CVE-2026-90684
CISA Vulnrichment
Updated Sep 14, 2026