CVE-2026-90687
- Source
- https://cve.org/CVERecord?id=CVE-2026-90687
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90687.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-90687
- Downstream
- Published
- 2026-09-14T05:45:09Z
- Modified
- 2026-09-15T08:10:57Z
- Severity
-
- 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
- Summary
- GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free
- Details
-
A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.
- Database specific
{ "cna_assigner": "VulDB", "cwe_ids": [ "CWE-119", "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90687.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "f1219cde" }, { "last_affected": "f1219cde" } ], "source": "AFFECTED_FIELD" } ] }- References
-
- https://github.com/gpac/gpac/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90687.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-90687
- https://vuldb.com/cve/CVE-2026-90687
- https://vuldb.com/submit/914121
- https://vuldb.com/vuln/403220
- https://github.com/gpac/gpac/issues/3800
- https://vuldb.com/vuln/403220/cti
- https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24
- https://github.com/gpac/gpac/releases/tag/abi-16.23
- https://github.com/Ech06/CVE_submit/blob/main/gpac_3800.md
Affected packages
Git / github.com/gpac/gpac
Affected versions
Other
abi-12
abi-13
abi-14
abi-15
abi-16
abi-12.*
abi-12.16
abi-12.17
abi-12.18
abi-12.19
abi-12.20
abi-12.21
abi-12.22
abi-12.23
abi-12.24
abi-12.25
abi-12.26
abi-12.27
abi-13.*
abi-13.0
abi-14.*
abi-14.0
abi-15.*
abi-15.0
abi-15.1
abi-15.2
abi-16.*
abi-16.10
abi-16.11
abi-16.13
abi-16.14
abi-16.15
abi-16.16
abi-16.17
abi-16.18
abi-16.19
abi-16.2
abi-16.20
abi-16.21
abi-16.22
abi-16.3
abi-16.4
abi-16.5
abi-16.6
abi-16.7
abi-16.8
abi-16.9
testtag0.*
testtag0.1
v0.*
v0.5.2
v0.6.0
v0.9.0
v0.9.0-preview
v1.*
v1.0.0
v2.*
v2.0.0
v2.2.0
v26.*
v26.02.0
v26.07.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90687.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "60823540465400110655145389395242055259",
"length": 1625
},
"id": "CVE-2026-90687-062a9f7a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/base_scenegraph.c",
"function": "gf_node_replace"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"290805028101592447850845285813473353912",
"118396174820326425799868880572086606749",
"205156296132713970872926628230661658458",
"232696690050175471801017822637085370652"
],
"threshold": 0.9
},
"id": "CVE-2026-90687-24717d3b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scene_manager/loader_bt.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "48295756588153345846283589256339961369",
"length": 1063
},
"id": "CVE-2026-90687-2fce2885",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/dom_events.c",
"function": "gf_sg_dom_event_bubble"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "111472608253496325668016521900531202841",
"length": 932
},
"id": "CVE-2026-90687-30aae47a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/base_scenegraph.c",
"function": "gf_node_activate_ex"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"33535434379441107037801626008864371709",
"159585290357705810194625383024322853013",
"332049873830475796628664114894732386156",
"194672398426588307647002716514358122230",
"177628327203484033563175207322869312709",
"224087343089186192921951965396529477935",
"91061689785927719676524819041130164345",
"104221026717868621152718163374627763641",
"42039298485788565342098205845886844335",
"110379387274143147120796664852142850941",
"59953391991428273092807664402671492156",
"57603539527938279146505859107605267175",
"42039298485788565342098205845886844335",
"154621877059020004615861418389674813304",
"330445446597699485566449214344896001290",
"71742309449079582188321612957072168992",
"116882259292260585881095466107216695552",
"91064336316882693477205687267082223798",
"254775438788570861343963625217009322814",
"266469855011855358171217527292980500715",
"53002559633163494250281185758936543721",
"239381356093102399942306617733615050677",
"325912465387707972048592288769009670655",
"216957615859300988380300661381352839544",
"116882259292260585881095466107216695552",
"160764056992731141793265607138111267106",
"126092901300084223107667920214337179297",
"255323075389552300519356011387551034482",
"248560834472668807607320294080161925382",
"188894141873960348193285174768476504490",
"12096911676082240895768200601660212440",
"72831441313465427429398167009422230727"
],
"threshold": 0.9
},
"id": "CVE-2026-90687-819a9d78",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scene_manager/loader_xmt.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "133603431258404249199478378209834894260",
"length": 737
},
"id": "CVE-2026-90687-83b51898",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/base_scenegraph.c",
"function": "drop_nested_node_codes"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "182192286411857883145960891710278734230",
"length": 110
},
"id": "CVE-2026-90687-84cced62",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/base_scenegraph.c",
"function": "gf_node_deactivate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "92632358225579962734539177075374098988",
"length": 2423
},
"id": "CVE-2026-90687-9af0249e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/laser/lsr_dec.c",
"function": "lsr_read_update_value_indexed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"298363963436022910951384398303170359813",
"263958099654079038671410279998868817916",
"221712343103980599506176189968370941874",
"1811305617094904268931071448910206100",
"17716454557899848392947374838533412912",
"312938282881100231873841259510374313216",
"8371149100337224364363570804269447603",
"147572700251097819989436978039265364469",
"17716454557899848392947374838533412912",
"312938282881100231873841259510374313216",
"8371149100337224364363570804269447603",
"147572700251097819989436978039265364469",
"94148467772358404230049652635077794002",
"265125240816984630206103563080898184418",
"233258248960968133511026627021536445669",
"36174458635597334595690785778131864224",
"187712270543344129650957838180698566908",
"609795640236965633520302898605553368",
"70101880774951410624145669636431689307",
"263251361831523669053383922791487572713",
"315725810552011504943424814666832087168",
"33488757642595701608746615323777475639",
"40802741994595458557254287816246593758",
"189784792298608615033136889693770904336",
"271849138611733325642366693669574151556",
"43057786332087092050327154261746014765",
"250120720102211024914796272264972483939",
"244724294594863251404552372606904566276",
"38817009236350840354039571032803871850",
"305860801812951744451805911104893093078",
"290802512245772158032800083894548588673",
"153531306846077242953417157950044327088",
"110083060213255789210669471818241850655",
"241612033558683106549584231807053575423",
"266655236844373721974718198792599548690",
"175843163322317821260565774748454181208",
"78352989259744833041369157028608679520",
"143399172548102719628974956877688967189",
"308147029221184621470327074234035008013",
"82777804884761666958922187858634598724",
"91495942980445202911241468629093478502",
"74092613649866161099243486039154768284",
"315542626976915611010003859278675678974",
"259813186936068947944009852955732049698",
"264009915150559088249681276031939215166",
"159008447843615840818259452110526710415",
"308862430777485748650155555831045857018",
"191911128407246892546245373756450451963",
"144572809137389134106558223431437114500",
"41246252382559663346718470603630451269",
"38355862390314445857055377332156808761",
"316779693996579679320634979245370342970",
"266362891694565734068471988753333433699"
],
"threshold": 0.9
},
"id": "CVE-2026-90687-a1ef1f7c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/base_scenegraph.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "287490260030873094742750284112165069131",
"length": 926
},
"id": "CVE-2026-90687-aa92778b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/base_scenegraph.c",
"function": "gf_node_deactivate_ex"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "61055651731110483685083098806188812387",
"length": 14177
},
"id": "CVE-2026-90687-b04b42a0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scene_manager/loader_xmt.c",
"function": "xmt_parse_element"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111779016251385522113390407980766881022",
"209494205099354379610664033756563557348",
"134118702025223334426368072823156242713",
"171360718430283626688832168216719134241"
],
"threshold": 0.9
},
"id": "CVE-2026-90687-bee190ba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/laser/lsr_dec.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "213403102856437142217802338412056761467",
"length": 15849
},
"id": "CVE-2026-90687-bf6d5d2e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scene_manager/loader_xmt.c",
"function": "xmt_node_end"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"177336444113191033645870606383339089864",
"213881210304715484440118202660713272870",
"275247316176001247492980742696928597700",
"223602979893202094053316637539285781747"
],
"threshold": 0.9
},
"id": "CVE-2026-90687-c0da866c",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/dom_events.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "88947420348595128248442035226277348163",
"length": 142
},
"id": "CVE-2026-90687-c128f506",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scenegraph/base_scenegraph.c",
"function": "gf_node_activate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "327329031742340762859969448033885001013",
"length": 7568
},
"id": "CVE-2026-90687-f5035a80",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24",
"target": {
"file": "src/scene_manager/loader_bt.c",
"function": "gf_bt_sf_node"
}
}
]
vanir_signatures_modified
"2026-09-15T08:10:57Z"