Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-91089

GPAC base_scenegraph.c gf_node_get_name_and_id use after free

CVSS 4.0 5.3 MEDIUMCVSS 3.1 6.3 MEDIUMCVSS 3.0 6.3 MEDIUMCVSS 2.0 7.5 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-91089

Published

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is recommended to address this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-91089

Published

GPAC

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "n/a",
                    "product": "GPAC",
                    "versions": [
                        {
                            "version": "f1219cde",
                            "status": "affected"
                        },
                        {
                            "version": "abi-16.23",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON