Vulnerability · Published Sep 14, 2026 · Assigned by VulDB

CVE-2026-90793GPAC MP4Box base_scenegraph.c gf_node_get_name use after free

Medium 5.4

In plain English

A medium-severity use-after-free in GPAC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.6%top 52.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

Affected products (as reported)

Vendor	Product	Versions
n/a	GPAC	f1219cde

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C

References

VDB-403299 | GPAC MP4Box base_scenegraph.c gf_node_get_name use after free vdb-entry, technical-description
VDB-403299 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-90793 | CVE Analysis and Report third-party-advisory
Submit #914124 | GPAC GPAC (MP4Box) gpac f1219cde (master, 2026-07-25) Use After Free third-party-advisory
https://github.com/gpac/gpac/issues/3803 issue-tracking
https://github.com/Ech06/CVE_submit/blob/main/gpac_3803.md exploit
https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24 patch
https://github.com/gpac/gpac/releases/tag/abi-16.23 patch
https://github.com/gpac/gpac/ product