CVE-2026-90683

CVE-2026-90683 affects GPAC (through commit f1219cde), specifically the MP4Box component. The vulnerability resides in the function gf_node_unregister in scenegraph/base_scenegraph.c and results in a reachable assertion failure, leading to a local denial-of-service. A local attack is required, wi...

EUVD-2026-77199

A vulnerability was detected in GPAC up to f1219cde. Affected is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used...

CVE-2026-90683 GPAC MP4Box base_scenegraph.c gf_node_unregister assertion

A vulnerability was detected in GPAC up to f1219cde. Affected is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used...

EUVD-2026-77198

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAGGPSLAT/TAGGPSLONG leads to heap-based buffer overflow. An attack has to be...

CVE-2026-90682

A heap-based buffer overflow in the ProcessGpsInfo function of gpsinfo.c (WebP EXIF Handler) affects Matthias-Wandel jhead up to 3.3 . Manipulation of the TAG_GPS_LAT/TAG_GPS_LONG arguments triggers the overflow. The attack vector is local with low privileges required, yielding partial impact on ...

CVE-2026-90682 Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAGGPSLAT/TAGGPSLONG leads to heap-based buffer overflow. An attack has to be...

CVE-2026-90682 Matthias-Wandel jhead WebP EXIF gpsinfo.c ProcessGpsInfo heap-based overflow

A security vulnerability has been detected in Matthias-Wandel jhead up to 3.3. This impacts the function ProcessGpsInfo of the file gpsinfo.c of the component WebP EXIF Handler. Such manipulation of the argument TAGGPSLAT/TAGGPSLONG leads to heap-based buffer overflow. An attack has to be...

CVE-2026-90622

A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...

CVE-2026-90622 GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference

A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...

CVE-2026-90622

GNU libredwg 0.13.4 is affected by a null pointer dereference in the DWG_TABLE function of the Layer Encoding component (src/dwg.spec). The root cause is two raw zeroing assignments introduced by commit 27118c40 ("encode: also disable LAYER.material") that dereferenced a NULL material handle , wh...

CVE-2026-90622 GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference

A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...

EUVD-2026-77189

A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...

CVE-2026-90622 GNU libredwg Layer Encoding dwg.spec DWG_TABLE null pointer dereference

A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWGTABLE of the file src/dwg.spec of the component Layer Encoding. Performing a manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the...

CVE-2026-90613

A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stblGetSampleInfos of the file isomedia/stblread.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit h...

CVE-2026-90612

A vulnerability was identified in GPAC up to f1219cde. Affected is the function gfsmdumpcommandlist of the file scenemanager/scenedump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be...

CVE-2026-90613

A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stblGetSampleInfos of the file isomedia/stblread.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit h...

UBUNTU-CVE-2026-90612

A vulnerability was identified in GPAC up to f1219cde. Affected is the function gfsmdumpcommandlist of the file scenemanager/scenedump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be...

CVE-2026-90612

A vulnerability was identified in GPAC up to f1219cde. Affected is the function gfsmdumpcommandlist of the file scenemanager/scenedump.c of the component MP4Box. The manipulation leads to reachable assertion. The attack must be carried out locally. The exploit is publicly available and might be...

CVE-2026-90613 GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion

A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stblGetSampleInfos of the file isomedia/stblread.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit h...

CVE-2026-90613

GPAC (component MP4Box ) contains a reachable assertion vulnerability in the function stbl_GetSampleInfos within the file isomedia/stbl_read.c , affecting versions up to commit f1219cde. The attack requires a local position with low privileges and results in a low availability impact (denial of s...