A vulnerability was determined in GPAC 26.07.0. (CVE-2026-90826)
A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
AI Analysis
Technical Summary
CVE-2026-90826 is an out-of-bounds read vulnerability in the gf_node_del function within the MP4Box component of GPAC 26.07.0. The vulnerability arises from improper memory handling, leading to potential memory access violations. Exploitation requires local access and user interaction, limiting the attack vector. The vulnerability has been publicly disclosed, indicating that exploit code or details are available. The issue is resolved by upgrading to GPAC version abi-16.23, which includes a patch identified by commit afca1f1181668d85941d51ed1adf647807d5d975.
Potential Impact
The vulnerability can cause an out-of-bounds read, which may lead to application instability or crashes (denial of service). There is no impact on confidentiality or integrity. Exploitation requires local privileges and user interaction, limiting the risk. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade the affected GPAC component to version abi-16.23, which contains the official patch for this vulnerability. No other mitigations are indicated or required.
A vulnerability was determined in GPAC 26.07.0. (CVE-2026-90826)
Description
A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gf_node_del of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 can resolve this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
CVSS v3.1
Score 2.8low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90826 is an out-of-bounds read vulnerability in the gf_node_del function within the MP4Box component of GPAC 26.07.0. The vulnerability arises from improper memory handling, leading to potential memory access violations. Exploitation requires local access and user interaction, limiting the attack vector. The vulnerability has been publicly disclosed, indicating that exploit code or details are available. The issue is resolved by upgrading to GPAC version abi-16.23, which includes a patch identified by commit afca1f1181668d85941d51ed1adf647807d5d975.
Potential Impact
The vulnerability can cause an out-of-bounds read, which may lead to application instability or crashes (denial of service). There is no impact on confidentiality or integrity. Exploitation requires local privileges and user interaction, limiting the risk. No known exploits in the wild have been reported.
Mitigation Recommendations
Upgrade the affected GPAC component to version abi-16.23, which contains the official patch for this vulnerability. No other mitigations are indicated or required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-qm3v-8qrj-ch7v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90826"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa8a16155bf5e2cf5f3b71d
Added to database: 09/15/2026, 01:37:37 UTC
Last enriched: 09/15/2026, 01:41:33 UTC
Last updated: 09/15/2026, 05:01:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.