A vulnerability was identified in GPAC 26.08-DEV. (CVE-2026-92473)
A use-after-free vulnerability exists in GPAC 26.08-DEV within the gf_sg_command_del function of the BIFS Handler component. The vulnerability requires local access to exploit and can cause denial of service by crashing the application. A patch is available in version abi-16.24 to resolve this issue.
AI Analysis
Technical Summary
CVE-2026-92473 identifies a use-after-free vulnerability in the function gf_sg_command_del located in src/scenegraph/commands.c of the BIFS Handler component in GPAC version 26.08-DEV. Exploitation requires local access and can lead to application instability or denial of service. The vulnerability has a low CVSS score of 3.3, reflecting limited impact and attack complexity. A patch identified by commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7 is available in GPAC version abi-16.24, which mitigates the issue.
Potential Impact
The vulnerability allows a local attacker to trigger a use-after-free condition, potentially causing application crashes and denial of service. There is no impact on confidentiality or integrity. The exploit is publicly available, but exploitation requires local privileges.
Mitigation Recommendations
Upgrade GPAC to version abi-16.24 or later, which includes the patch e34f4ba349d55cd1849f0bcf4cf46552732e2db7 that fixes this use-after-free vulnerability. No other mitigations are specifically recommended.
A vulnerability was identified in GPAC 26.08-DEV. (CVE-2026-92473)
Description
A use-after-free vulnerability exists in GPAC 26.08-DEV within the gf_sg_command_del function of the BIFS Handler component. The vulnerability requires local access to exploit and can cause denial of service by crashing the application. A patch is available in version abi-16.24 to resolve this issue.
CVSS v3.1
Score 3.3low
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-92473 identifies a use-after-free vulnerability in the function gf_sg_command_del located in src/scenegraph/commands.c of the BIFS Handler component in GPAC version 26.08-DEV. Exploitation requires local access and can lead to application instability or denial of service. The vulnerability has a low CVSS score of 3.3, reflecting limited impact and attack complexity. A patch identified by commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7 is available in GPAC version abi-16.24, which mitigates the issue.
Potential Impact
The vulnerability allows a local attacker to trigger a use-after-free condition, potentially causing application crashes and denial of service. There is no impact on confidentiality or integrity. The exploit is publicly available, but exploitation requires local privileges.
Mitigation Recommendations
Upgrade GPAC to version abi-16.24 or later, which includes the patch e34f4ba349d55cd1849f0bcf4cf46552732e2db7 that fixes this use-after-free vulnerability. No other mitigations are specifically recommended.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-wf7c-2jr3-g777
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-92473"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aab49aa55bf5e2cf5992906
Added to database: 09/17/2026, 02:00:10 UTC
Last enriched: 09/17/2026, 02:41:15 UTC
Last updated: 09/17/2026, 05:01:40 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.