{"id":"CVE-2026-90613","title":"A security flaw has been discovered in GPAC up to f1219cde","summary":"A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c of the component MP4Box. The manipulation results in reachable assertion. The…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-617"],"product":"GPAC","affected":["GPAC f1219cde"],"published":"2026-09-14","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:18:34.507","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-90613","references":[{"url":"https://github.com/gpac/gpac/","label":"cna@vuldb.com"},{"url":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","label":"cna@vuldb.com"},{"url":"https://github.com/gpac/gpac/issues/3822","label":"cna@vuldb.com"},{"url":"https://github.com/gpac/gpac/releases/tag/abi-16.23","label":"cna@vuldb.com"},{"url":"https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-Assertion-Failure-in-stbl-Handling.md","label":"cna@vuldb.com"},{"url":"https://vuldb.com/cve/CVE-2026-90613","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/913520","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/403195","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/403195/cti","label":"cna@vuldb.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-16T14:38:36.687992Z"},"epss":0.00118,"epssPercentile":0.01938,"ingestedAt":"2026-09-14T15:23:07.467Z","slug":"CVE-2026-90613","body":"## Overview\n\nA security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":30,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":205235,"id":"CVE-2026-90613","ts":1789570705863,"field":"exploit_available","old":"false","new":"true"}]}