Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 492

Export CSV
CVE-2026-91090

GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow

A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-92472

GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free

A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90573

GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Upgrading to version abi-16.23 is sufficient to resolve this issue. The identifier of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is recommended to upgrade the affected component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90826

GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds

A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90793

GPAC MP4Box base_scenegraph.c gf_node_get_name use after free

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is recommended to address this issue. The name of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90685

GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion

A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsr_exec_command_list of the file laser/lsr_dec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 can resolve this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. The affected component should be upgraded.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90613

GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion

A security flaw has been discovered in GPAC up to f1219cde. Affected by this vulnerability is the function stbl_GetSampleInfos of the file isomedia/stbl_read.c of the component MP4Box. The manipulation results in reachable assertion. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90825

GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 addresses this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is advised.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-91089

GPAC base_scenegraph.c gf_node_get_name_and_id use after free

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is recommended to address this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90683

GPAC MP4Box base_scenegraph.c gf_node_unregister assertion

A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in reachable assertion. Attacking locally is a requirement. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to address this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. It is advisable to upgrade the affected component. This is not a duplicate of CVE-2021-46237 or CVE-2021-46234.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90578

GPAC MP4Box list.c gf_list_count use after free

A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf_list_count of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version abi-16.23 can resolve this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90611

GPAC MP4Box loader_xmt.c xmt_parse_element assertion

A vulnerability was determined in GPAC up to f1219cde. This impacts the function xmt_parse_element of the file scene_manager/loader_xmt.c of the component MP4Box. Executing a manipulation can lead to reachable assertion. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 will fix this issue. This patch is called afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-79513

Divide‑by‑Zero Vulnerability in GPAC Dash Client Allows Denial of Service

A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-79522

GPAC Downloader Out-of-Bounds Read Allows DoS via HTTP

An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-91091

GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-91088

GPAC URL url.c gf_url_concatenate_ex heap-based overflow

A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable of addressing this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-91086

GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow

A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filters/reframe_mpgvid.c of the component MPEG Video Reframer. Such manipulation leads to heap-based buffer overflow. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 can resolve this issue. The name of the patch is afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90824

GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow

A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90791

GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

A vulnerability was detected in GPAC up to f1219cde. This vulnerability affects the function gf_node_unregister of the file scenegraph/base_scenegraph.c of the component MP4Box. The manipulation results in use after free. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version abi-16.23 is able to resolve this issue. The patch is identified as 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac
CVE-2026-90577

GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version abi-16.23 addresses this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. The affected component should be upgraded.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Gpac
Products
Gpac