GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion
cve-program · CVE-2026-90612
PublishedA vulnerability was identified in GPAC up to f1219cde. Affected is the function gf_sm_dump_command_list of the file scene_manager/scene_dump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is advised.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-90612 · CVE overview and exploitation status
cve-program · CVE-2026-90612
- https://vuldb.com/vuln/403194
- https://vuldb.com/vuln/403194/cti
- https://vuldb.com/cve/CVE-2026-90612
- https://vuldb.com/submit/913519
- https://github.com/gpac/gpac/issues/3821
- https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-Assertion-Failure-in-scene-dump-(sdump-current_com_list).md
- https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975
- https://github.com/gpac/gpac/releases/tag/abi-16.23
- https://github.com/gpac/gpac/
Related changes
Linked by CVE identifierNo related changes are available here.