Description
A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
Published: 2026-09-14
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Local stack-based buffer overflow enabling code execution
Action: Patch Immediately
AI Analysis

Impact

The flaw is a stack-based buffer overflow in the gf_sg_dom_event_bubble function of the MP4Box component in GPAC version 26.07.0. When this function processes specially crafted input, the buffer is overrun, potentially allowing an attacker to overwrite the stack and execute arbitrary code or crash the process. The vulnerability is classified as local, requiring the attacker to.

Affected Systems

It affects the GPAC project’s MP4Box utility. The issue exists in the 26.07.0 release and has been fixed in the abi-16.23 release. The patch identifier is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. All GPAC products identified by the CPE string are potentially affected if they include the vulnerable version.

Risk and Exploitability

The CVSS score of 4.8 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. Since the exploit is local only, the risk is limited to users who can run MP4Box with untrusted data. The stack overflow could lead to code execution or denial of service if an attacker controls input. The risk remains moderate but could be high if local privilege is available. The publicly disclosed exploit means the vulnerability can be used if the local environment is compromised.

Generated by OpenCVE AI on September 15, 2026 at 08:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update GPAC to version abi-16.23 or newer, which includes the patched gf_sg_dom_event_bubble function.
  • If using a custom or older source build, integrate the patch identified by commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24 before compiling.
  • Until an updated binary or source is deployed, restrict usage of MP4Box to trusted scripts and data, or sandbox the process to mitigate local exploitation risks.

Generated by OpenCVE AI on September 15, 2026 at 08:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
Title GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-15T14:44:51.797Z

Reserved: 2026-09-13T19:16:38.471Z

Link: CVE-2026-90824

cve-icon Vulnrichment

Updated: 2026-09-15T14:44:24.148Z

cve-icon NVD

Status : Deferred

Published: 2026-09-14T21:17:42.550

Modified: 2026-09-15T15:17:30.223

Link: CVE-2026-90824

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-15T08:30:13Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-121

    Stack-based Buffer Overflow