Description
A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.
Published: 2026-09-15
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Use‑after‑free exploitation potentially allowing remote code execution
Action: Apply Patch
AI Analysis

Impact

This flaw resides in the GPAC Compositor’s gf_mo_get_od_id function in media_object.c. The vulnerability is a use‑after‑free that can be triggered by manipulating media objects. If successfully exploited, the attacker can corrupt memory and potentially execute arbitrary code. The description states that the flaw is remotely exploitable and been published.

Affected Systems

GPAC versions up to commit f1219cde are affected. The issue is fixed in the abi‑16.24 release, which includes commit e34f4ba349d55cd1849f0bcf4cf46552732e2 binaries must upgrade to this release to remediate the flaw.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. EPSS is below 1 %, so the overall likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the attack can be performed remotely and exploits are available, the risk remains non‑negligible for exposed systems.

Generated by OpenCVE AI on September 17, 2026 at 18:32 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GPAC to version abi‑16.24
  • Isolate the Compositor component from untrusted input—use firewalls, sandboxing, or network segmentation to restrict remote media object processing
  • Monitor system logs for abnormal crashes or suspicious activity related to GPAC, and keep the CVE status tracked to apply future updates promptly

Generated by OpenCVE AI on September 17, 2026 at 18:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.
Title GPAC Compositor media_object.c gf_mo_get_od_id use after free
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-416
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-09-15T13:53:41.584Z

Reserved: 2026-09-14T17:59:51.522Z

Link: CVE-2026-91087

cve-icon Vulnrichment

Updated: 2026-09-15T13:47:09.266Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T07:16:34.237

Modified: 2026-09-15T14:37:14.523

Link: CVE-2026-91087

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T20:45:16Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-416

    Use After Free