PT-2026-91251

A flaw has been found in GPAC up to f1219cde. This issue affects the function gf node list get child of the file scenegraph/base scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The...

CVE-2026-90825: Use After Free

A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public a...

CVE-2026-90792: NULL Pointer Dereference

A flaw has been found in GPAC up to f1219cde. This issue affects the function gfnodelistgetchild of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploi...

CVE-2026-90791: Use After Free

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-90793: Use After Free

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gfnodegetname of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may b...

ROS-20260914-73-0001

The vulnerability of the loadxmtrun function in the MP4Box multimedia platform’s utility software, related to the use of memory after its release during processing an incorrect XMT scene, allows a intruder to cause a service failure...

CVE-2026-90683: Reachable Assertion

A vulnerability was detected in GPAC up to f1219cde. Affected is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used...

Linux Distros Unpatched Vulnerability : CVE-2026-90576

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gfnodelistaddchild of the file scenegraph/basescenegraph.c of the...

Linux Distros Unpatched Vulnerability : CVE-2026-90577

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfield of the file scenegraph/basescenegraph.c of th...

CVE-2026-90685: Reachable Assertion

A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsrexeccommandlist of the file laser/lsrdec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to t...

CVE-2026-90577

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfield of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The...

CVE-2026-90578

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gflistcount of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used...

CVE-2026-90576

A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gfnodelistaddchild of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The explo...

CVE-2026-90578 GPAC MP4Box list.c gf_list_count use after free

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gflistcount of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used...

CVE-2026-90578 GPAC MP4Box list.c gf_list_count use after free

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gflistcount of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used...

EUVD-2026-77063

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gflistcount of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used...

CVE-2026-90578

A use-after-free vulnerability exists in the gf_list_count function (utils/list.c) of the MP4Box component in GPAC (affected up to commit f1219cde). The flaw can be triggered via local manipulation with low privileges required and no user interaction, leading to partial compromise of confidential...

CVE-2026-90578 GPAC MP4Box list.c gf_list_count use after free

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gflistcount of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used...

CVE-2026-90577 GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gfnodegetfield of the file scenegraph/basescenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The...

CVE-2026-90577

CVE-2026-90577 is a heap-based buffer overflow in the MP4Box component of GPAC (up to commit f1219cde), specifically in the function gf_node_get_field within scenegraph/base_scenegraph.c. The vulnerability requires local access with low privileges and no user interaction, resulting in low impact ...