CVE-2026-91089
Received Received - Intake

Use After Free in GPAC

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is recommended to address this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91089
EUVD
EUVD-2026-78315

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gpac gpac to f1219cde (inc)
gpac gpac abi-16.23
gpac gpac to f1219cde (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in GPAC up to version f1219cde. It occurs in the function gf_node_get_name_and_id within the file scenegraph/base_scenegraph.c. The issue arises when processing a crafted MP4 file using the MP4Box -bt command, which attempts to dump a BT representation of a malformed scene. A freed node's name or ID is read during this process, leading to a heap-use-after-free read at line 1362.

Detection Guidance

To detect this vulnerability, monitor for crashes or memory corruption when processing MP4 files with GPAC's MP4Box tool using the -bt command. Check logs for heap-use-after-free errors in scenegraph/base_scenegraph.c around line 1362. Use the provided proof-of-concept file poc_16_bt.zip to test if your system is vulnerable.

Impact Analysis

An attacker could remotely exploit this vulnerability by providing a specially crafted MP4 file. This could lead to arbitrary code execution, crashes, or data corruption on the affected system. The exploit has been publicly disclosed, increasing the risk of real-world attacks.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch identified as 49dee5cad329cfed310c1682703df7daa47df31a. Avoid processing untrusted MP4 files with the MP4Box -bt command until patched. Monitor for suspicious activity or crashes in GPAC-related processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91089. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart