CVE-2026-90791

A use after free vulnerability was identified in the GPAC media processing toolkit, specifically in the function gf_node_unregister within scenegraph/base_scenegraph.c of the MP4Box component (affected up to commit f1219cde). The flaw can be triggered remotely with no privileges but requires user...

CVE-2026-90791 GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used...

Astra Linux – Vulnerability in gpac

A vulnerability has been discovered in GPAC 2.5-DEV-rev228-g11067ea92-master. This vulnerability affects the xmtnodeend function in the src/scenemanager/loaderxmt.c file of the MP4Box component. The vulnerability allows for data to be accessed after it has been freed from memory, requiring local...

CVE-2026-90687

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-90685

A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsrexeccommandlist of the file laser/lsrdec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to t...

CVE-2026-90686

A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading...

CVE-2026-90686

A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading...

CVE-2026-90687

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been...

UBUNTU-CVE-2026-90687

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-90685

A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsrexeccommandlist of the file laser/lsrdec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to t...

UBUNTU-CVE-2026-90685

A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsrexeccommandlist of the file laser/lsrdec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to t...

UBUNTU-CVE-2026-90686

A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading...

CVE-2026-90687

GPAC (up to commit f1219cde) contains a use-after-free vulnerability in the function gf_node_changed_internal within the file scenegraph/base_scenegraph.c , part of the MP4Box component. The flaw can be triggered remotely with no privileges required but requires user interaction (per CVSS 3.1: 6....

CVE-2026-90687 GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-77206

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-90687 GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-90687 GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gfnodechangedinternal of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-77205

A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading...

CVE-2026-90686

GPAC up to commit f1219cde is affected by a memory corruption vulnerability in the gf_bt_report function of scene_manager/loader_bt.c within the MP4Box component. The flaw can be triggered remotely without authentication or user interaction, resulting in a low availability impact with no confiden...

CVE-2026-90686 GPAC MP4Box loader_bt.c gf_bt_report memory corruption

A vulnerability was found in GPAC up to f1219cde. This affects the function gfbtreport of the file scenemanager/loaderbt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading...