Quick answers
- Is CVE-2026-90793 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90793 being exploited in the wild.
- How severe is CVE-2026-90793?
- Medium severity, with a CVSS score of 5.4, published 14 September 2026.
- Which products and versions are affected?
- Gpac up to commit f1219cde; fixed in abi-16.23 (commit 9eb40df4).
- Is there a fix for CVE-2026-90793?
- A patch was published on 2026-07-27: Fix commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-90793 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-90793?
- Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A heap use-after-free vulnerability exists in the gf_node_get_name function within GPAC's base_scenegraph.c. The root cause is in the error-handling path of gf_bt_sf_node(): when node parsing fails, the partially constructed node is freed and unregistered, but the stale pointer remains in the parser's def_nodes list. Subsequent DEF/USE resolution calls gf_node_get_name() on the dangling pointer, triggering a use-after-free read. The attack vector is remote (processing untrusted BT scene files via MP4Box -add). The vulnerability can cause denial-of-service via crash, and potentially more severe memory corruption. The fix (commit 9eb40df4) removes the failed node from the def_nodes list before freeing it.
Affected products
- GPAC GPAC up to commit f1219cde; fixed in abi-16.23 (commit 9eb40df4)
Timeline
- 2026-09-14: disclosed: Published in NVD
- 2026-07-27: patched: Fix commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24