Vulnerability · Published Sep 14, 2026 · Assigned by VulDB

CVE-2026-90687GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free

Medium 6.3

In plain English

A medium-severity use-after-free in GPAC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.5%top 56.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

Affected products (as reported)

Vendor	Product	Versions
n/a	GPAC	f1219cde

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

References

VDB-403220 | GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free vdb-entry, technical-description
VDB-403220 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-90687 | CVE Analysis and Report third-party-advisory
Submit #914121 | GPAC GPAC (MP4Box) gpac f1219cde (master, 2026-07-25) Use After Free third-party-advisory
https://github.com/gpac/gpac/issues/3800 issue-tracking
https://github.com/Ech06/CVE_submit/blob/main/gpac_3800.md exploit
https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24 patch
https://github.com/gpac/gpac/releases/tag/abi-16.23 patch
https://github.com/gpac/gpac/ product