Vulnerability · Published Sep 14, 2026 · Assigned by VulDB

CVE-2026-90825GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

Low 3.3

In plain English

A low-severity use-after-free in GPAC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.2%top 93.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

Affected products (as reported)

Vendor	Product	Versions
n/a	GPAC	26.07.0

Weakness: CWE-416, CWE-119 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References

VDB-403327 | GPAC MP4Box base_scenegraph.c gf_node_unregister use after free vdb-entry, technical-description
VDB-403327 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-90825 | CVE Analysis and Report third-party-advisory
Submit #914950 | GPAC GPAC MP4Box v26.07.0 Heap Use-After-Free third-party-advisory
https://github.com/gpac/gpac/issues/3805 issue-tracking
https://github.com/user-attachments/files/30399108/poc_09_add.zip exploit
https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24 patch
https://github.com/gpac/gpac/releases/tag/abi-16.23 patch
https://github.com/gpac/gpac/ product