CVE-2026-90578
- Source
- https://cve.org/CVERecord?id=CVE-2026-90578
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90578.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-90578
- Downstream
- Published
- 2026-09-13T18:45:10Z
- Modified
- 2026-09-16T08:09:40Z
- Severity
-
- 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- GPAC MP4Box list.c gf_list_count use after free
- Details
-
A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf_list_count of the file utils/list.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version abi-16.23 can resolve this issue. This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-119", "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90578.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "f1219cde" }, { "last_affected": "f1219cde" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://github.com/gpac/gpac/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90578.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-90578
- https://vuldb.com/cve/CVE-2026-90578
- https://vuldb.com/submit/913217
- https://vuldb.com/vuln/403163
- https://github.com/gpac/gpac/issues/3817
- https://vuldb.com/vuln/403163/cti
- https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a
- https://github.com/gpac/gpac/releases/tag/abi-16.23
- https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-SEGV-in-gf_list_count-(Use-After-Free).md
Affected packages
Git / github.com/gpac/gpac
Affected versions
Other
abi-12
abi-13
abi-14
abi-15
abi-16
abi-12.*
abi-12.16
abi-12.17
abi-12.18
abi-12.19
abi-12.20
abi-12.21
abi-12.22
abi-12.23
abi-12.24
abi-12.25
abi-12.26
abi-12.27
abi-13.*
abi-13.0
abi-14.*
abi-14.0
abi-15.*
abi-15.0
abi-15.1
abi-15.2
abi-16.*
abi-16.10
abi-16.11
abi-16.13
abi-16.14
abi-16.15
abi-16.16
abi-16.17
abi-16.18
abi-16.19
abi-16.2
abi-16.20
abi-16.21
abi-16.22
abi-16.3
abi-16.4
abi-16.5
abi-16.6
abi-16.7
abi-16.8
abi-16.9
testtag0.*
testtag0.1
v0.*
v0.5.2
v0.6.0
v0.9.0
v0.9.0-preview
v1.*
v1.0.0
v2.*
v2.0.0
v2.2.0
v26.*
v26.02.0
v26.07.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90578.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"145568147277314144082398432589161068189",
"323211987463172907832753121077838423608",
"334072999313077448348278629071219093542",
"213978246609415984910756497938366017899"
],
"threshold": 0.9
},
"id": "CVE-2026-90578-09f178fa",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/filters/reframe_av1.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"51108576564257053543762696819462400282",
"259294840328832389959544726322151380567",
"59916539506646210065194847055678448728",
"300238807050437853936955135568176966059",
"223769201974597684531500193741212411747",
"80660733125987452001085054117914048875",
"112169619435561680698232603363042782692"
],
"threshold": 0.9
},
"id": "CVE-2026-90578-1f46133a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/scenegraph/mpeg4_nodes.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "110679161136971273473639213289741930210",
"length": 20812
},
"id": "CVE-2026-90578-4284c46a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/scenegraph/commands.c",
"function": "gf_sg_command_apply"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"147536943697249079035706747598503564734",
"180365077083521959581071390618345875318",
"149849326907462702416618439744907718963",
"286983107300281276276126212713909112572",
"148477810192675453311669414321021064024",
"190087602732512230006224780797679455998",
"336532700609265496841581701912467920779",
"326806907354868459117004192629848673584",
"227617894656014770987083667594120534066",
"24899471506566668329937456348500100634",
"264693999720362236485313853524336779919",
"302493109199944252982541211289961409443",
"46368018197146278258553442124028920780",
"215149624363657437922484929731917417210",
"37867514156452346326986740760781908113",
"222183624422528106982773505064446576252",
"291069491497401340471846751945819966083",
"323223917251683367930741110311073798791",
"18403397235814300454259003377670222441",
"134872008201039988041264569341423215953",
"177640702022945235168216420352199218181",
"113879128291352974963062731613758716664",
"19933239194241197540978350586546716750",
"245383467138744127285303003179184955889",
"326001593262479683116210744341192136249",
"151201200353499652464408063935342739827",
"172582215120833753484026159805828678903",
"30783840051806744457568375892216035462",
"88038167991520071126773205738070860505",
"40192783619291773512338438983331118277",
"221424299816246942408565640542875951557",
"5916113629173319018029415570670112244",
"290432414286531761704770270361060805095",
"224920701753858603778765707360561748335",
"333691578320893850762132764586332555380",
"255679118715834011638776356924563771803",
"9637449175148878297326849521786678700",
"2900191331276494887583535642015596987",
"13912753293743701810876331924825868362",
"101446507389067663741746203727121836291",
"5092182401575760448158436481769051228",
"78172134178391555769734790493933641828",
"209152032244892839572881788989983566328",
"286380198406238391078272032151434629154",
"30527383283422602096787284980783555123",
"11247223268726087318439216693010282983",
"42774649623972014715016031940156629294",
"65774717527263739803776224747876595734",
"163883418825477740050951133079222839051",
"31724486513268962269874225092817835453",
"58640825953397247505305865900669395303",
"168712411040866165964010099380256112209",
"315953152171888289537801269542211198193",
"110119779893672570976909573984440417467",
"247319429788758275004267526203687853987",
"217083565178372531805298780806913715671",
"2319126982271237675221298237637263214",
"151233742438379964812110924526928359940",
"314123323461200580056182813221999011344",
"101544941233740050352686074842487951889",
"226942897151747738292842826715593120154",
"328854836869614143130137610250298486310",
"241137933226780567054813380950841005310",
"184622039706441227678943503522799979539",
"326883459483184029125924967618096669793",
"165489656172682608002436997205450196995",
"181317148935100078742315232707165458040",
"219254147037112348770768279595070882864",
"198775773111772597843052186194354571224",
"54253094396603683023327363726259777927",
"206074244124457382909015175945303133578",
"215715076636292665508551977548961503924",
"210246945655770628041175383097780003974",
"35041636026114195342657937436058986843",
"52488114991414420010222361399879893430",
"42887715405456392586645118649894794482",
"267151358152728303260964870808574490966",
"295589502716072907993460826749349175697",
"111031422318297434156197505726518874561",
"100796941578235663691349192811866411238",
"185076579164073168711499010814537770936",
"9897305032982273739260172744775141366",
"26816136754012716575760231505021086320",
"47861304606170835893511053887171932533",
"45812448866405334550829456506986446318",
"124226154064331509758495946125328098234",
"327223246231406435363355841865187930421",
"13654824939334430689196612698949392138",
"213569114595933453229262561267807574106",
"234742182919368639685910261188238282454",
"36398969570630724873449335017530334830",
"89460459017334606591288178839697340327"
],
"threshold": 0.9
},
"id": "CVE-2026-90578-4e5417f9",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "include/gpac/nodes_mpeg4.h"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"105668341748784375936048444601661497381",
"148716304083886404736159906051395179438",
"333507788344831057281980461550618436063",
"167755651240568112732193600699833486806",
"131307465396708341726123088559244716126",
"306334000837811938979353149634261830437",
"6348656499965048336015214936067289422",
"171755878346977172663573355464133479295",
"136391763172658037986712785569209077462"
],
"threshold": 0.9
},
"id": "CVE-2026-90578-522fda2b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/scenegraph/base_scenegraph.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"18338864011790866004979176460894329456",
"67772603066413577908091567069653092573",
"123394936464620136456372734200001554687",
"41987364153921571867877910780105801198",
"314356419965637283597120691318154642304",
"281698872907481534309761915126316310343",
"163029304514665856433432131778653150603",
"112852922152970817244426376348067257015",
"16482202852593543480457146122382640422",
"146251124110270106525950113852804063805",
"10673853558738566635447801969456323255",
"332576237667675739953344124318433482317",
"27246929458718933464429137945820028447",
"144191661868105578777541189136006623482",
"295685489450405597430200073077303797272"
],
"threshold": 0.9
},
"id": "CVE-2026-90578-65e7be48",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/scenegraph/commands.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"330951025480852290243322711281109911524",
"268958645049925214856556524610513622450",
"77636670369008926126507289888067489620",
"212240802830844622881508648532467196082",
"99973312259619464562119361090553934008"
],
"threshold": 0.9
},
"id": "CVE-2026-90578-7be9d067",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/isomedia/stbl_read.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "297281011097424578928675254672104782429",
"length": 2056
},
"id": "CVE-2026-90578-7c863735",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/scenegraph/base_scenegraph.c",
"function": "gf_node_unregister"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "328474621599003302468564523322295207815",
"length": 523
},
"id": "CVE-2026-90578-8ccd4282",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/scenegraph/base_scenegraph.c",
"function": "gf_node_get_name_and_id"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "116808008205299623724416564895384631922",
"length": 4872
},
"id": "CVE-2026-90578-914e8961",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/isomedia/stbl_read.c",
"function": "stbl_GetSampleInfos"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "144823296414848606497376621830204273614",
"length": 112
},
"id": "CVE-2026-90578-b3340768",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/bifs/memory_decoder.c",
"function": "BM_SetCommandNode"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "77443310539649747089950137094885543730",
"length": 850
},
"id": "CVE-2026-90578-c950a62a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/filters/reframe_av1.c",
"function": "av1dmx_finalize"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "149210170149027857112913617042760274831",
"length": 2127
},
"id": "CVE-2026-90578-cee88015",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/bifs/memory_decoder.c",
"function": "BM_SceneReplace"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"97569568486296816099576400378578043672",
"74676460320029070107128333646053296250",
"180686892485981921186842681732466959691",
"186435786590208089846954081251170838004",
"58043030319113911406377195596333465346",
"267352510094796094311561905687109302706",
"275112358198120634208418847559781555842"
],
"threshold": 0.9
},
"id": "CVE-2026-90578-dccad5c8",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/bifs/memory_decoder.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41207922805155943257858638291999689045",
"length": 2897
},
"id": "CVE-2026-90578-ec0077f6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
"target": {
"file": "src/scenegraph/mpeg4_nodes.c",
"function": "gf_sg_mpeg4_node_get_child_ndt"
}
}
]
vanir_signatures_modified
"2026-09-16T08:09:40Z"