Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-92472

GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free

CVSS 4.0 4.8 MEDIUMCVSS 3.1 3.3 LOWCVSS 3.0 3.3 LOWCVSS 2.0 1.7 Check source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-92472

Published

A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-92472

Published

GPAC

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "n/a",
                    "product": "GPAC",
                    "versions": [
                        {
                            "version": "26.08-DEV",
                            "status": "affected"
                        },
                        {
                            "version": "abi-16.24",
                            "status": "unaffected"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"
                    ],
                    "modules": [
                        "MP4Box"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON