CVE-2026-90613 GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion
A local attacker can trigger a reachable assertion in GPAC MP4Box, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90613?
CVE-2026-90613 is a medium-severity denial of service vulnerability in GPAC, published on 14 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component.
Weakness: CWE-617
Which versions are affected by CVE-2026-90613?
How do I fix CVE-2026-90613?
No fix has been published for CVE-2026-90613 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90613 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90613 exists.
Sources
Also known as GHSA-69g9-hrxq-rv88.