CVE-2026-90685
lowA vulnerability has been found in GPAC up to f1219cde.
A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsr_exec_command_list of the file laser/lsr_dec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 can resolve this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. The affected component should be upgraded.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/gpac/gpac/ cna@vuldb.com
- https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975 cna@vuldb.com
- https://github.com/gpac/gpac/issues/3825 cna@vuldb.com
- https://github.com/gpac/gpac/releases/tag/abi-16.23 cna@vuldb.com
- https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln%20GPAC%20MP4Box%20Assertion%20Failur... cna@vuldb.com
- https://vuldb.com/cve/CVE-2026-90685 cna@vuldb.com
- https://vuldb.com/submit/914027 cna@vuldb.com
- https://vuldb.com/vuln/403218 cna@vuldb.com
- https://vuldb.com/vuln/403218/cti cna@vuldb.com