CVE Feed

    Dashboard / CVE / CVE-2026-90686

    CVE-2026-90686

    A vulnerability was found in GPAC up to f1219cde. This affects the function gf_bt_report of the file scene_manager/loader_bt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.

    Published:Sep 14, 2026
    Last Modified:Sep 14, 2026
    EPS:Sep 14, 2026
    EPSS Score:0.00496
    CVSS Score:5.3

    Affected Products

    Vendor
    Gpac
    Product
    Gpac

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-109827 (CVSS 2.1) — A vulnerability has been found in GPAC up to 26.07.0. This vulnerability affects the function gf_m2ts_decode_a…
    CVE-2026-108539 (CVSS 2.1) — A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_cor…
    CVE-2026-108538 (CVSS 2.1) — A security vulnerability has been detected in GPAC up to 26.07.0. The impacted element is the function gf_mx_v…
    CVE-2026-103227 (CVSS 5.3) — A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_u…
    CVE-2026-88339 (CVSS 5.5) — A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.…
    CVE-2026-93331 (CVSS 6.9) — A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of…
    CVE-2026-92475 (CVSS 1.9) — A weakness has been identified in GPAC 26.08-DEV. This impacts the function wait_for_header_and_parse of the f…
    CVE-2026-92474 (CVSS 1.9) — A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of th…
    CVE-2026-92473 (CVSS 1.9) — A vulnerability was identified in GPAC 26.08-DEV. The impacted element is the function gf_sg_command_del of th…
    CVE-2026-92472 (CVSS 1.9) — A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex o…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High