CVE-2026-90827

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-90827
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90827.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-90827
Published
2026-09-14T21:45:09Z
Modified
2026-09-16T08:05:20Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
Details

A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-119",
        "CWE-416"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90827.json"
}
References

Affected packages

Git / github.com/gpac/gpac

Affected ranges

Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
a07cbfff238a331233e11e916f9fb185d5da8604
Fixed
49dee5cad329cfed310c1682703df7daa47df31a
Fixed
2aa431eaf732c1a7e9a966ea12049fc001d91e04
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "26.07.0"
        },
        {
            "last_affected": "26.07.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

26.*
26.07.0
abi-16.*
abi-16.22
v26.*
v26.07.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90827.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "145568147277314144082398432589161068189",
                "323211987463172907832753121077838423608",
                "334072999313077448348278629071219093542",
                "213978246609415984910756497938366017899"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90827-09f178fa",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/filters/reframe_av1.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "51108576564257053543762696819462400282",
                "259294840328832389959544726322151380567",
                "59916539506646210065194847055678448728",
                "300238807050437853936955135568176966059",
                "223769201974597684531500193741212411747",
                "80660733125987452001085054117914048875",
                "112169619435561680698232603363042782692"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90827-1f46133a",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/scenegraph/mpeg4_nodes.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "110679161136971273473639213289741930210",
            "length": 20812
        },
        "id": "CVE-2026-90827-4284c46a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/scenegraph/commands.c",
            "function": "gf_sg_command_apply"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "147536943697249079035706747598503564734",
                "180365077083521959581071390618345875318",
                "149849326907462702416618439744907718963",
                "286983107300281276276126212713909112572",
                "148477810192675453311669414321021064024",
                "190087602732512230006224780797679455998",
                "336532700609265496841581701912467920779",
                "326806907354868459117004192629848673584",
                "227617894656014770987083667594120534066",
                "24899471506566668329937456348500100634",
                "264693999720362236485313853524336779919",
                "302493109199944252982541211289961409443",
                "46368018197146278258553442124028920780",
                "215149624363657437922484929731917417210",
                "37867514156452346326986740760781908113",
                "222183624422528106982773505064446576252",
                "291069491497401340471846751945819966083",
                "323223917251683367930741110311073798791",
                "18403397235814300454259003377670222441",
                "134872008201039988041264569341423215953",
                "177640702022945235168216420352199218181",
                "113879128291352974963062731613758716664",
                "19933239194241197540978350586546716750",
                "245383467138744127285303003179184955889",
                "326001593262479683116210744341192136249",
                "151201200353499652464408063935342739827",
                "172582215120833753484026159805828678903",
                "30783840051806744457568375892216035462",
                "88038167991520071126773205738070860505",
                "40192783619291773512338438983331118277",
                "221424299816246942408565640542875951557",
                "5916113629173319018029415570670112244",
                "290432414286531761704770270361060805095",
                "224920701753858603778765707360561748335",
                "333691578320893850762132764586332555380",
                "255679118715834011638776356924563771803",
                "9637449175148878297326849521786678700",
                "2900191331276494887583535642015596987",
                "13912753293743701810876331924825868362",
                "101446507389067663741746203727121836291",
                "5092182401575760448158436481769051228",
                "78172134178391555769734790493933641828",
                "209152032244892839572881788989983566328",
                "286380198406238391078272032151434629154",
                "30527383283422602096787284980783555123",
                "11247223268726087318439216693010282983",
                "42774649623972014715016031940156629294",
                "65774717527263739803776224747876595734",
                "163883418825477740050951133079222839051",
                "31724486513268962269874225092817835453",
                "58640825953397247505305865900669395303",
                "168712411040866165964010099380256112209",
                "315953152171888289537801269542211198193",
                "110119779893672570976909573984440417467",
                "247319429788758275004267526203687853987",
                "217083565178372531805298780806913715671",
                "2319126982271237675221298237637263214",
                "151233742438379964812110924526928359940",
                "314123323461200580056182813221999011344",
                "101544941233740050352686074842487951889",
                "226942897151747738292842826715593120154",
                "328854836869614143130137610250298486310",
                "241137933226780567054813380950841005310",
                "184622039706441227678943503522799979539",
                "326883459483184029125924967618096669793",
                "165489656172682608002436997205450196995",
                "181317148935100078742315232707165458040",
                "219254147037112348770768279595070882864",
                "198775773111772597843052186194354571224",
                "54253094396603683023327363726259777927",
                "206074244124457382909015175945303133578",
                "215715076636292665508551977548961503924",
                "210246945655770628041175383097780003974",
                "35041636026114195342657937436058986843",
                "52488114991414420010222361399879893430",
                "42887715405456392586645118649894794482",
                "267151358152728303260964870808574490966",
                "295589502716072907993460826749349175697",
                "111031422318297434156197505726518874561",
                "100796941578235663691349192811866411238",
                "185076579164073168711499010814537770936",
                "9897305032982273739260172744775141366",
                "26816136754012716575760231505021086320",
                "47861304606170835893511053887171932533",
                "45812448866405334550829456506986446318",
                "124226154064331509758495946125328098234",
                "327223246231406435363355841865187930421",
                "13654824939334430689196612698949392138",
                "213569114595933453229262561267807574106",
                "234742182919368639685910261188238282454",
                "36398969570630724873449335017530334830",
                "89460459017334606591288178839697340327"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90827-4e5417f9",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "include/gpac/nodes_mpeg4.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "105668341748784375936048444601661497381",
                "148716304083886404736159906051395179438",
                "333507788344831057281980461550618436063",
                "167755651240568112732193600699833486806",
                "131307465396708341726123088559244716126",
                "306334000837811938979353149634261830437",
                "6348656499965048336015214936067289422",
                "171755878346977172663573355464133479295",
                "136391763172658037986712785569209077462"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90827-522fda2b",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/scenegraph/base_scenegraph.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "18338864011790866004979176460894329456",
                "67772603066413577908091567069653092573",
                "123394936464620136456372734200001554687",
                "41987364153921571867877910780105801198",
                "314356419965637283597120691318154642304",
                "281698872907481534309761915126316310343",
                "163029304514665856433432131778653150603",
                "112852922152970817244426376348067257015",
                "16482202852593543480457146122382640422",
                "146251124110270106525950113852804063805",
                "10673853558738566635447801969456323255",
                "332576237667675739953344124318433482317",
                "27246929458718933464429137945820028447",
                "144191661868105578777541189136006623482",
                "295685489450405597430200073077303797272"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90827-65e7be48",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/scenegraph/commands.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "330951025480852290243322711281109911524",
                "268958645049925214856556524610513622450",
                "77636670369008926126507289888067489620",
                "212240802830844622881508648532467196082",
                "99973312259619464562119361090553934008"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90827-7be9d067",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/isomedia/stbl_read.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "297281011097424578928675254672104782429",
            "length": 2056
        },
        "id": "CVE-2026-90827-7c863735",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/scenegraph/base_scenegraph.c",
            "function": "gf_node_unregister"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "328474621599003302468564523322295207815",
            "length": 523
        },
        "id": "CVE-2026-90827-8ccd4282",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/scenegraph/base_scenegraph.c",
            "function": "gf_node_get_name_and_id"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "116808008205299623724416564895384631922",
            "length": 4872
        },
        "id": "CVE-2026-90827-914e8961",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/isomedia/stbl_read.c",
            "function": "stbl_GetSampleInfos"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "144823296414848606497376621830204273614",
            "length": 112
        },
        "id": "CVE-2026-90827-b3340768",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/bifs/memory_decoder.c",
            "function": "BM_SetCommandNode"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "77443310539649747089950137094885543730",
            "length": 850
        },
        "id": "CVE-2026-90827-c950a62a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/filters/reframe_av1.c",
            "function": "av1dmx_finalize"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "149210170149027857112913617042760274831",
            "length": 2127
        },
        "id": "CVE-2026-90827-cee88015",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/bifs/memory_decoder.c",
            "function": "BM_SceneReplace"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "97569568486296816099576400378578043672",
                "74676460320029070107128333646053296250",
                "180686892485981921186842681732466959691",
                "186435786590208089846954081251170838004",
                "58043030319113911406377195596333465346",
                "267352510094796094311561905687109302706",
                "275112358198120634208418847559781555842"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-90827-dccad5c8",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/bifs/memory_decoder.c"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "41207922805155943257858638291999689045",
            "length": 2897
        },
        "id": "CVE-2026-90827-ec0077f6",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a",
        "target": {
            "file": "src/scenegraph/mpeg4_nodes.c",
            "function": "gf_sg_mpeg4_node_get_child_ndt"
        }
    }
]
vanir_signatures_modified 
"2026-09-16T08:05:20Z"