CVE-2026-90612

EUVD-2026-77167

14.09.2026, 02:17

A vulnerability was identified in GPAC up to f1219cde. Affected is the function gf_sm_dump_command_list of the file scene_manager/scene_dump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is advised.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.3 LOW	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-617 - Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References

https://github.com/gpac/gpac/

https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975

https://github.com/gpac/gpac/issues/3821

https://github.com/gpac/gpac/releases/tag/abi-16.23

https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-Assertion-Failure-in-scene-dump-(sdump-current_com_list).md

https://vuldb.com/cve/CVE-2026-90612

https://vuldb.com/submit/913519

https://vuldb.com/vuln/403194

https://vuldb.com/vuln/403194/cti