CVE-2026-90687
GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
| CWE | CWE-416 CWE-119 |
| Vendor | n/a |
| Product | gpac |
| Published | Sep 14, 2026 |
| Last Updated | Sep 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a gpac
Be the first to know when new medium vulnerabilities affecting n/a gpac are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / GPAC
f1219cde
References
vuldb.com: https://vuldb.com/vuln/403220 vuldb.com: https://vuldb.com/vuln/403220/cti vuldb.com: https://vuldb.com/cve/CVE-2026-90687 vuldb.com: https://vuldb.com/submit/914121 github.com: https://github.com/gpac/gpac/issues/3800 github.com: https://github.com/Ech06/CVE_submit/blob/main/gpac_3800.md github.com: https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24 github.com: https://github.com/gpac/gpac/releases/tag/abi-16.23 github.com: https://github.com/gpac/gpac/
Credits
🔍 Ech06 (VulDB User)