Is CVE-2026-91087 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-91087 being exploited in the wild.

How severe is CVE-2026-91087?

High severity, with a CVSS score of 7.3, published 15 September 2026.

Which products and versions are affected?

GPAC Project GPAC up to f1219cde (before abi-16.24).

Is there a fix for CVE-2026-91087?

A patch was published on 2026-08-03: Fix published in commit e34f4ba, included in version abi-16.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-91087 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-91087?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-91087: GPAC use-after-free in media object compositor

CVE-2026-91087 · Severity: high · CVSS 7.3 · Published 2026-09-15

GPAC is a multimedia framework used for video streaming and media transcoding. A use-after-free vulnerability in the media object compositor component could allow remote attackers to cause crashes or potentially execute arbitrary code by sending specially crafted multimedia content.

Quick answers

Is CVE-2026-91087 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-91087 being exploited in the wild.
How severe is CVE-2026-91087?: High severity, with a CVSS score of 7.3, published 15 September 2026.
Which products and versions are affected?: GPAC Project GPAC up to f1219cde (before abi-16.24).
Is there a fix for CVE-2026-91087?: A patch was published on 2026-08-03: Fix published in commit e34f4ba, included in version abi-16.24 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91087 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-91087?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free vulnerability exists in the gf_mo_get_od_id function within compositor/media_object.c of GPAC up to commit f1219cde. The vulnerability can be triggered remotely without authentication by providing malicious input to the compositor component. An attacker can exploit this flaw to read or write memory after it has been freed, potentially leading to information disclosure or code execution. The issue was patched in commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7 (included in version abi-16.24).

Affected products

GPAC Project GPAC up to f1219cde (before abi-16.24)

Timeline

2026-09-15: disclosed: CVE-2026-91087 disclosed
2026-08-03: patched: Fix published in commit e34f4ba, included in version abi-16.24

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.