5.3
Medium
CVE-2026-90687 A vulnerability was determined in GPAC up to f1219cde
Description
A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GPAC | Versions not published |
References
- VDB-403220 | GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free vuldb.com
- VDB-403220 | CTI Indicators (IOB, IOC, IOA) vuldb.com
- CVE-2026-90687 | CVE Analysis and Report vuldb.com
- Submit #914121 | GPAC GPAC (MP4Box) gpac f1219cde (master, 2026-07-25) Use After Free vuldb.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of GPAC
The 80 CVEs of GPAC →
CVE-2026-109827
A vulnerability has been found in GPAC up to 26.07.0
5.3
Medium
CVE-2026-108539
A vulnerability was detected in GPAC up to 26.07.0
5.3
Medium
CVE-2026-108538
A security vulnerability has been detected in GPAC up to 26.07.0
5.3
Medium
CVE-2026-103227
A weakness has been identified in GPAC up to 26.07.0
5.3
Medium