What’s Vulnerable › Vulnerabilities

CVE-2026-90824: GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-15
• Weakness: CWE-119

Description

A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.

Affected products

• GPAC: 26.07.0

References

• https://github.com/gpac/gpac/
• https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24
• https://github.com/gpac/gpac/issues/3804
• https://github.com/gpac/gpac/releases/tag/abi-16.23
• https://github.com/user-attachments/files/30398880/poc_08_add.zip
• https://vuldb.com/cve/CVE-2026-90824
• https://vuldb.com/submit/914949
• https://vuldb.com/vuln/403326
• https://vuldb.com/vuln/403326/cti
• https://github.com/gpac/gpac/issues/3804
• https://vuldb.com/submit/914949

Get alerted when CVE-2026-90824 or the next vulnerability affects your stack