{"id":"CVE-2026-90687","summary":"GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free","details":"A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.","modified":"2026-09-15T08:10:57.100705Z","published":"2026-09-14T05:45:09.744Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-119","CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90687.json","unresolved_ranges":[{"extracted_events":[{"introduced":"f1219cde"},{"last_affected":"f1219cde"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://github.com/gpac/gpac/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90687.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90687"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90687"},{"type":"ADVISORY","url":"https://vuldb.com/submit/914121"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403220"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/3800"},{"type":"REPORT","url":"https://vuldb.com/vuln/403220/cti"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24"},{"type":"FIX","url":"https://github.com/gpac/gpac/releases/tag/abi-16.23"},{"type":"EVIDENCE","url":"https://github.com/Ech06/CVE_submit/blob/main/gpac_3800.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"9eb40df4448b88d6a6ce3454657c06f47eff0b24"},{"fixed":"2aa431eaf732c1a7e9a966ea12049fc001d91e04"}],"database_specific":{"source":"REFERENCES"}}],"versions":["abi-16.22","v26.07.0","abi-16.21","abi-16.20","abi-16.19","abi-16.18","abi-16.17","abi-16.16","abi-16.15","abi-16.14","abi-16.13","abi-16.11","abi-16.10","abi-16.9","abi-16.8","abi-16.7","abi-16.6","v26.02.0","abi-16.5","abi-16.4","abi-16.3","abi-16.2","abi-16","abi-15.2","abi-15.1","abi-15.0","abi-15","abi-14.0","abi-14","abi-13.0","abi-13","abi-12.27","abi-12.26","abi-12.25","abi-12.24","abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"vanir_signatures_modified":"2026-09-15T08:10:57Z","vanir_signatures":[{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_replace"},"deprecated":false,"digest":{"function_hash":"60823540465400110655145389395242055259","length":1625},"id":"CVE-2026-90687-062a9f7a"},{"deprecated":false,"digest":{"line_hashes":["290805028101592447850845285813473353912","118396174820326425799868880572086606749","205156296132713970872926628230661658458","232696690050175471801017822637085370652"],"threshold":0.9},"id":"CVE-2026-90687-24717d3b","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_bt.c"}},{"id":"CVE-2026-90687-2fce2885","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/dom_events.c","function":"gf_sg_dom_event_bubble"},"deprecated":false,"digest":{"function_hash":"48295756588153345846283589256339961369","length":1063}},{"id":"CVE-2026-90687-30aae47a","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_activate_ex"},"deprecated":false,"digest":{"function_hash":"111472608253496325668016521900531202841","length":932}},{"target":{"file":"src/scene_manager/loader_xmt.c"},"deprecated":false,"digest":{"line_hashes":["33535434379441107037801626008864371709","159585290357705810194625383024322853013","332049873830475796628664114894732386156","194672398426588307647002716514358122230","177628327203484033563175207322869312709","224087343089186192921951965396529477935","91061689785927719676524819041130164345","104221026717868621152718163374627763641","42039298485788565342098205845886844335","110379387274143147120796664852142850941","59953391991428273092807664402671492156","57603539527938279146505859107605267175","42039298485788565342098205845886844335","154621877059020004615861418389674813304","330445446597699485566449214344896001290","71742309449079582188321612957072168992","116882259292260585881095466107216695552","91064336316882693477205687267082223798","254775438788570861343963625217009322814","266469855011855358171217527292980500715","53002559633163494250281185758936543721","239381356093102399942306617733615050677","325912465387707972048592288769009670655","216957615859300988380300661381352839544","116882259292260585881095466107216695552","160764056992731141793265607138111267106","126092901300084223107667920214337179297","255323075389552300519356011387551034482","248560834472668807607320294080161925382","188894141873960348193285174768476504490","12096911676082240895768200601660212440","72831441313465427429398167009422230727"],"threshold":0.9},"id":"CVE-2026-90687-819a9d78","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24"},{"source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"drop_nested_node_codes"},"deprecated":false,"digest":{"length":737,"function_hash":"133603431258404249199478378209834894260"},"id":"CVE-2026-90687-83b51898","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"182192286411857883145960891710278734230","length":110},"id":"CVE-2026-90687-84cced62","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_deactivate"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"92632358225579962734539177075374098988","length":2423},"id":"CVE-2026-90687-9af0249e","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/laser/lsr_dec.c","function":"lsr_read_update_value_indexed"}},{"id":"CVE-2026-90687-a1ef1f7c","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c"},"deprecated":false,"digest":{"line_hashes":["298363963436022910951384398303170359813","263958099654079038671410279998868817916","221712343103980599506176189968370941874","1811305617094904268931071448910206100","17716454557899848392947374838533412912","312938282881100231873841259510374313216","8371149100337224364363570804269447603","147572700251097819989436978039265364469","17716454557899848392947374838533412912","312938282881100231873841259510374313216","8371149100337224364363570804269447603","147572700251097819989436978039265364469","94148467772358404230049652635077794002","265125240816984630206103563080898184418","233258248960968133511026627021536445669","36174458635597334595690785778131864224","187712270543344129650957838180698566908","609795640236965633520302898605553368","70101880774951410624145669636431689307","263251361831523669053383922791487572713","315725810552011504943424814666832087168","33488757642595701608746615323777475639","40802741994595458557254287816246593758","189784792298608615033136889693770904336","271849138611733325642366693669574151556","43057786332087092050327154261746014765","250120720102211024914796272264972483939","244724294594863251404552372606904566276","38817009236350840354039571032803871850","305860801812951744451805911104893093078","290802512245772158032800083894548588673","153531306846077242953417157950044327088","110083060213255789210669471818241850655","241612033558683106549584231807053575423","266655236844373721974718198792599548690","175843163322317821260565774748454181208","78352989259744833041369157028608679520","143399172548102719628974956877688967189","308147029221184621470327074234035008013","82777804884761666958922187858634598724","91495942980445202911241468629093478502","74092613649866161099243486039154768284","315542626976915611010003859278675678974","259813186936068947944009852955732049698","264009915150559088249681276031939215166","159008447843615840818259452110526710415","308862430777485748650155555831045857018","191911128407246892546245373756450451963","144572809137389134106558223431437114500","41246252382559663346718470603630451269","38355862390314445857055377332156808761","316779693996579679320634979245370342970","266362891694565734068471988753333433699"],"threshold":0.9}},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_deactivate_ex"},"deprecated":false,"digest":{"function_hash":"287490260030873094742750284112165069131","length":926},"id":"CVE-2026-90687-aa92778b","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"61055651731110483685083098806188812387","length":14177},"id":"CVE-2026-90687-b04b42a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_xmt.c","function":"xmt_parse_element"}},{"target":{"file":"src/laser/lsr_dec.c"},"deprecated":false,"digest":{"line_hashes":["111779016251385522113390407980766881022","209494205099354379610664033756563557348","134118702025223334426368072823156242713","171360718430283626688832168216719134241"],"threshold":0.9},"id":"CVE-2026-90687-bee190ba","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24"},{"digest":{"function_hash":"213403102856437142217802338412056761467","length":15849},"id":"CVE-2026-90687-bf6d5d2e","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_xmt.c","function":"xmt_node_end"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["177336444113191033645870606383339089864","213881210304715484440118202660713272870","275247316176001247492980742696928597700","223602979893202094053316637539285781747"],"threshold":0.9},"id":"CVE-2026-90687-c0da866c","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/dom_events.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_activate"},"deprecated":false,"digest":{"function_hash":"88947420348595128248442035226277348163","length":142},"id":"CVE-2026-90687-c128f506"},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_bt.c","function":"gf_bt_sf_node"},"deprecated":false,"digest":{"function_hash":"327329031742340762859969448033885001013","length":7568},"id":"CVE-2026-90687-f5035a80","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90687.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}]}