CVE-2026-91087
Received Received - Intake

Use After Free in GPAC Compositor

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91087
EUVD
EUVD-2026-78302

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gpac gpac to f1219cde (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in GPAC up to version f1219cde. It occurs in the function gf_mo_get_od_id within compositor/media_object.c. The flaw allows an attacker to manipulate a media object after it has been freed, leading to potential memory corruption or crashes. The issue is triggered when processing a crafted MP4 file using the MP4Box -info command.

Detection Guidance

Detect this vulnerability by checking GPAC versions. Run 'MP4Box -version' to see if your version is below the patched release. Monitor for crashes or memory errors when processing MP4 files, especially with 'MP4Box -info' on crafted files.

Impact Analysis

An attacker could exploit this to execute arbitrary code, cause denial-of-service, or access sensitive information by crafting a malicious MP4 file. Since the attack can be performed remotely and exploits are publicly available, users processing untrusted media files are at risk.

Compliance Impact

This vulnerability, a use-after-free flaw in GPAC, could potentially lead to unauthorized memory access or crashes during media processing. While not directly tied to GDPR or HIPAA, such vulnerabilities may violate compliance requirements for data integrity and security in systems handling sensitive media content, depending on implementation and deployment context.

Mitigation Strategies

Upgrade GPAC to version abi-16.24 or later using the patch e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Avoid processing untrusted MP4 files with tools like MP4Box until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91087. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart