CVE-2026-90827

EUVD-2026-78165

14.09.2026, 22:16

A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.3 LOW	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

https://github.com/gpac/gpac/

https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a

https://github.com/gpac/gpac/issues/3813

https://github.com/gpac/gpac/releases/tag/abi-16.23

https://github.com/user-attachments/files/30400423/poc_20_nstatx.zip

https://vuldb.com/cve/CVE-2026-90827

https://vuldb.com/submit/914952

https://vuldb.com/vuln/403329

https://vuldb.com/vuln/403329/cti