CVE-2026-91090 - GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow

Back Back to CVE browser

LOW

GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow

Published Sep 15, 2026

2.4

LOW

CVSS 4.0

EPSS 0.17%

Description

A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.

Affected products

Vendor Gpac Product GPAC Default
n/a
- Version
  f1219cde
  Status
  affected
  Constraints
  -
Vendor Gpac Product GPAC Default
n/a
- Version
  abi-16.23
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Gpac

GPAC

n/a

Version	Status	Constraints
f1219cde	affected	-

Gpac

GPAC

n/a

Version	Status	Constraints
abi-16.23	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-121

References (10)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78316
Advisory
https://github.com/gpac/gpac/
product
https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24
patch
https://github.com/gpac/gpac/issues/3810
issue-tracking
https://github.com/gpac/gpac/releases/tag/abi-16.23
patch
https://github.com/user-attachments/files/30399928/poc_17_nstatx.zip
exploit
https://vuldb.com/cve/CVE-2026-91090
third-party-advisory
https://vuldb.com/submit/919759
third-party-advisory
https://vuldb.com/vuln/403652
vdb-entrytechnical-description
https://vuldb.com/vuln/403652/cti
signaturepermissions-required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78316		Advisory
https://github.com/gpac/gpac/		product
https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24		patch
https://github.com/gpac/gpac/issues/3810		issue-tracking
https://github.com/gpac/gpac/releases/tag/abi-16.23		patch
https://github.com/user-attachments/files/30399928/poc_17_nstatx.zip		exploit
https://vuldb.com/cve/CVE-2026-91090		third-party-advisory
https://vuldb.com/submit/919759		third-party-advisory
https://vuldb.com/vuln/403652		vdb-entrytechnical-description
https://vuldb.com/vuln/403652/cti		signaturepermissions-required