Description
A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
Published: 2026-09-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use after free leading to remote exploitation
Action: Patch Now
AI Analysis

Impact

A vulnerability in GPAC MP4Box may trigger a use‑after‑free condition via manipulation of the gf_node_unregister function in base_scenegraph.c. When an attacker supplies a crafted media file, the function frees a node while other references still exist, resulting in memory corruption. This use‑after‑free flaw is reflected in the disclosed weakness (CWE‑416) and can potentially destabilize the MP4Box process.

Affected Systems

The issue affects all GPAC distributions up to commit f1219cde, including the MP4Box component. Updating to the abi‑16.23 release or any later version incorporates the patch that resolves the problem.

Risk and Exploitability

Based on the CVSS score of 5.3, the vulnerability is considered moderate. No EPSS data is provided, and it is not listed in CISA KEV. The exploit is public and can be executed remotely by feeding a crafted media file to MP4Box. The reported use‑after‑free indicates a path for potential exploitation, but the official description does not specify whether this results in code execution or denial of service.

Generated by OpenCVE AI on September 15, 2026 at 13:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Download and install the GPAC release abi‑16.23 or any later version that includes the gf_node_unregister fix.
  • If compiling from source, apply the patch commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24 to the codebase, then rebuild MP4Box.
  • Replace the existing MP4Box binary with the updated version and validate that the functionality in your environment remains stable.

Generated by OpenCVE AI on September 15, 2026 at 13:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
Title GPAC MP4Box base_scenegraph.c gf_node_unregister use after free
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-416
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-15T14:59:55.743Z

Reserved: 2026-09-13T13:37:00.738Z

Link: CVE-2026-90791

cve-icon Vulnrichment

Updated: 2026-09-15T14:58:28.745Z

cve-icon NVD

Status : Deferred

Published: 2026-09-14T15:17:13.417

Modified: 2026-09-15T15:17:29.397

Link: CVE-2026-90791

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T14:00:11Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free