Quick answers
- Is CVE-2026-91089 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-91089 being exploited in the wild.
- How severe is CVE-2026-91089?
- Medium severity, with a CVSS score of 6.3, published 15 September 2026.
- Which products and versions are affected?
- Gpac up to f1219cde.
- Is there a fix for CVE-2026-91089?
- A patch was published on 2026-07-28: Patch commit 49dee5cad329cfed310c1682703df7daa47df31a; fixed in version abi-16.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-91089 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-91089?
- Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a use-after-free flaw in the gf_node_get_name_and_id function in scenegraph/base_scenegraph.c. The root cause involves improper memory management where a previously freed memory region is accessed. The attack vector is remote and does not require authentication; an attacker can trigger the vulnerability by providing a specially crafted multimedia file to an application using the affected GPAC library. Exploitation could result in denial of service (crash) or potentially arbitrary code execution. The issue has been patched; upgrading to version abi-16.23 or applying commit 49dee5cad329cfed310c1682703df7daa47df31a is recommended.
Affected products
- GPAC GPAC up to f1219cde
Timeline
- 2026-09-15: disclosed
- 2026-07-28: patched: Patch commit 49dee5cad329cfed310c1682703df7daa47df31a; fixed in version abi-16.23