CVE-2026-90612

Name of the Vulnerable Software and Affected Versions GPAC versions prior to abi-16.23

Description A flaw exists in the MP4Box component within the gf sm dump command list() function of the scene manager/scene dump.c file. Local manipulation can trigger a reachable assertion, which is a check used during development to ensure the program state is valid, and if it fails, the program terminates.

Recommendations Update to version abi-16.23. As a temporary workaround, restrict local access to the MP4Box component to minimize the risk of exploitation.