CVE-2026-90827
Low
Description
A vulnerability was identified in GPAC 26.07.0. This affects the function gf_node_deactivate_ex of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
SeverityLow
CVSS3.3
Exploit probability—
ProductGpac
PublishedSep 14, 2026
First seenSep 14, 2026
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gpac gpac | 26.07.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.