CVE-2026-91090
Received Received - Intake

Stack-Based Buffer Overflow in GPAC

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description
A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91090
EUVD
EUVD-2026-78316

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gpac gpac to f1219cde (exc)
gpac gpac to f1219cde (inc)
gpac gpac abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stack-based buffer overflow in GPAC up to version f1219cde. It occurs in the function gf_node_activate_ex within the file scenegraph/base_scenegraph.c. The issue arises from unbounded recursion when processing crafted MP4 files with the -nstatx command, leading to stack overflow and potential application crashes.

Detection Guidance

To detect this vulnerability, check if GPAC is running a vulnerable version (up to f1219cde) by inspecting the installed version. Use commands like `gpac -version` or `MP4Box -version` to verify. If the version is below abi-16.23, the system is vulnerable. Monitor for crashes when processing MP4 files with the `-nstatx` command, as this may indicate exploitation attempts.

Impact Analysis

The vulnerability can cause application crashes by exhausting the stack. It may allow local attackers to execute arbitrary code or disrupt services. Exploitation requires user interaction, such as processing a malicious MP4 file with the -nstatx command.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or later immediately. This can be done by downloading the latest release from the GPAC GitHub repository or using package managers. After upgrading, verify the installation with version commands. Avoid processing untrusted MP4 files with the `-nstatx` command until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91090. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart