Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by VulDB

CVE-2026-91088GPAC URL url.c gf_url_concatenate_ex heap-based overflow

Medium 4.8

In plain English

A medium-severity heap buffer overflow in GPAC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium
Exploit odds (30 days)0.2%top 94.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable of addressing this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.

Affected products (as reported)

VendorProductVersions
n/a GPAC f1219cde

Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References