CVE-2026-92473

LOW 3.3

GPAC BIFS commands.c gf_sg_command_del use after free

CVSS Score

3.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gf_sg_command_del of the file src/scenegraph/commands.c of the component BIFS Handler. The manipulation leads to use after free. The attack needs to be performed locally. The exploit is publicly available and might be used. Upgrading to version abi-16.24 is sufficient to resolve this issue. The identifier of the patch is e34f4ba349d55cd1849f0bcf4cf46552732e2db7. It is suggested to upgrade the affected component.

CWE	CWE-416 CWE-119
Vendor	n/a
Product	gpac
Published	Sep 16, 2026

Stay Ahead of the Next One

Get instant alerts for n/a gpac

Be the first to know when new low vulnerabilities affecting n/a gpac are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / GPAC

26.08-DEV

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/405732 vuldb.com: https://vuldb.com/vuln/405732/cti vuldb.com: https://vuldb.com/cve/CVE-2026-92473 vuldb.com: https://vuldb.com/submit/941004 github.com: https://github.com/gpac/gpac/issues/3830 github.com: https://github.com/user-attachments/files/30635904/poc_10.zip github.com: https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7 github.com: https://github.com/gpac/gpac/releases/tag/abi-16.24 github.com: https://github.com/gpac/gpac/

Credits

🔍 fczhang (VulDB User)