CVE-2026-90793: Use After Free in GPAC
CVE-2026-90793 is a use-after-free vulnerability in the GPAC project's MP4Box component, specifically in the function gf_node_get_name within scenegraph/base_scenegraph.c. This flaw allows remote attackers to cause memory corruption by manipulating the vulnerable function. The vulnerability has a medium severity with a CVSS score of 5.3. A patch is available in GPAC version abi-16.23, which addresses the issue.
AI Analysis
Technical Summary
The vulnerability identified as CVE-2026-90793 affects GPAC up to commit f1219cde. It exists in the gf_node_get_name function of the MP4Box component's scenegraph/base_scenegraph.c file. The flaw is a use-after-free condition triggered by improper handling of memory, which can be exploited remotely without privileges or user interaction. The vulnerability has been publicly disclosed, and an official patch is available in version abi-16.23, identified by commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24.
Potential Impact
Successful exploitation of this use-after-free vulnerability can lead to memory corruption, potentially causing application crashes or enabling further attacks such as code execution or denial of service. The vulnerability is remotely exploitable without authentication, increasing its risk profile. However, the CVSS score of 5.3 indicates a medium severity impact.
Mitigation Recommendations
Upgrade GPAC to version abi-16.23 or later, which contains the official fix for this vulnerability. Applying this update will remediate the use-after-free condition in the gf_node_get_name function. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-90793: Use After Free in GPAC
Description
CVE-2026-90793 is a use-after-free vulnerability in the GPAC project's MP4Box component, specifically in the function gf_node_get_name within scenegraph/base_scenegraph.c. This flaw allows remote attackers to cause memory corruption by manipulating the vulnerable function. The vulnerability has a medium severity with a CVSS score of 5.3. A patch is available in GPAC version abi-16.23, which addresses the issue.
CVSS v4.0
Score 5.3medium
Affected software
GPAC
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability identified as CVE-2026-90793 affects GPAC up to commit f1219cde. It exists in the gf_node_get_name function of the MP4Box component's scenegraph/base_scenegraph.c file. The flaw is a use-after-free condition triggered by improper handling of memory, which can be exploited remotely without privileges or user interaction. The vulnerability has been publicly disclosed, and an official patch is available in version abi-16.23, identified by commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24.
Potential Impact
Successful exploitation of this use-after-free vulnerability can lead to memory corruption, potentially causing application crashes or enabling further attacks such as code execution or denial of service. The vulnerability is remotely exploitable without authentication, increasing its risk profile. However, the CVSS score of 5.3 indicates a medium severity impact.
Mitigation Recommendations
Upgrade GPAC to version abi-16.23 or later, which contains the official fix for this vulnerability. Applying this update will remediate the use-after-free condition in the gf_node_get_name function. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-09-13T13:37:07.849Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aa8137255bf5e2cf53ffb41
Added to database: 09/14/2026, 15:32:02 UTC
Last enriched: 09/14/2026, 15:46:38 UTC
Last updated: 09/14/2026, 16:09:21 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.