CVE-2026-91087: GPAC Compositor media_object.c gf_mo_get_od_id use after free

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-15 · updated 2026-09-15
Weakness: CWE-119

Description

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.

Affected products

GPAC: f1219cde

References

https://github.com/gpac/gpac/
https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7
https://github.com/gpac/gpac/issues/3807
https://github.com/gpac/gpac/releases/tag/abi-16.24
https://github.com/user-attachments/files/30399593/poc_12_info.zip
https://vuldb.com/cve/CVE-2026-91087
https://vuldb.com/submit/919756
https://vuldb.com/vuln/403649
https://vuldb.com/vuln/403649/cti

Get alerted when CVE-2026-91087 or the next vulnerability affects your stack