Junglewise Threat Intelligence

CVE-2026-91089: GPAC use after free in gf_node_get_name_and_id

CVE-2026-91089 · Severity: medium · CVSS 6.3 · Published 2026-09-15

Executive brief

GPAC is an open-source multimedia framework used for video streaming and content transcoding. A use-after-free vulnerability in its scene graph parser could allow a remote attacker to crash the application or potentially execute arbitrary code by crafting a malicious multimedia file.

Technical details

The vulnerability is a use-after-free flaw in the gf_node_get_name_and_id function in scenegraph/base_scenegraph.c. The root cause involves improper memory management where a previously freed memory region is accessed. The attack vector is remote and does not require authentication; an attacker can trigger the vulnerability by providing a specially crafted multimedia file to an application using the affected GPAC library. Exploitation could result in denial of service (crash) or potentially arbitrary code execution. The issue has been patched; upgrading to version abi-16.23 or applying commit 49dee5cad329cfed310c1682703df7daa47df31a is recommended.

Affected products

  • GPAC GPAC up to f1219cde

Timeline

  • 2026-09-15: disclosed
  • 2026-07-28: patched: Patch commit 49dee5cad329cfed310c1682703df7daa47df31a; fixed in version abi-16.23

References

Related threats