CVE-2026-90685

CVE-2026-90685 affects GPAC (up to commit f1219cde), specifically the function lsr_exec_command_list in the file laser/lsr_dec.c within the MP4Box component. The root cause is a reachable assertion (assert(!codec-bs)), leading to a denial of service with LOW availability impact. Attack requires l...