What’s Vulnerable › Vulnerabilities

CVE-2026-90577: GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-13 · updated 2026-09-15
• Weakness: CWE-119

Description

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf_node_get_field of the file scenegraph/base_scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. The exploit is now public and may be used. Upgrading to version abi-16.23 addresses this issue. The patch is named 49dee5cad329cfed310c1682703df7daa47df31a. The affected component should be upgraded.

Affected products

• GPAC: f1219cde

References

• https://github.com/gpac/gpac/
• https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a
• https://github.com/gpac/gpac/issues/3816
• https://github.com/gpac/gpac/releases/tag/abi-16.23
• https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-Heap-Buffer-Overflow-in-gf_node_get_field.md
• https://vuldb.com/cve/CVE-2026-90577
• https://vuldb.com/submit/913216
• https://vuldb.com/vuln/403162
• https://vuldb.com/vuln/403162/cti

Get alerted when CVE-2026-90577 or the next vulnerability affects your stack