GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read
Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.
cve-program · CVE-2026-90610
PublishedA vulnerability was found in GPAC up to f1219cde. This affects the function gf_svg_attributes_copy of the file scenegraph/svg_attributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 mitigates this issue. The patch is named afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-90610 · CVE overview and exploitation status
cve-program · CVE-2026-90610
- https://vuldb.com/vuln/403192
- https://vuldb.com/vuln/403192/cti
- https://vuldb.com/cve/CVE-2026-90610
- https://vuldb.com/submit/913516
- https://github.com/gpac/gpac/issues/3819
- https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln%20GPAC%20MP4Box%20Heap-Buffer-Overflow%20READ%20size%2020%20in%20gf_svg_attributes_copy.md
- https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975
- https://github.com/gpac/gpac/releases/tag/abi-16.23
- https://github.com/gpac/gpac/
This historical advisory does not include today's related changes. Open the latest advisory to find current connections.