{"id":"CVE-2026-90824","summary":"GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow","details":"A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.","modified":"2026-09-17T08:02:16.996298Z","published":"2026-09-14T21:00:13.906Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-119","CWE-121"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90824.json"},"references":[{"type":"WEB","url":"https://github.com/gpac/gpac/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90824.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90824"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90824"},{"type":"ADVISORY","url":"https://vuldb.com/submit/914949"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403326"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/3804"},{"type":"REPORT","url":"https://vuldb.com/vuln/403326/cti"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24"},{"type":"FIX","url":"https://github.com/gpac/gpac/releases/tag/abi-16.23"},{"type":"EVIDENCE","url":"https://github.com/user-attachments/files/30398880/poc_08_add.zip"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"a07cbfff238a331233e11e916f9fb185d5da8604"},{"fixed":"9eb40df4448b88d6a6ce3454657c06f47eff0b24"},{"fixed":"2aa431eaf732c1a7e9a966ea12049fc001d91e04"}],"database_specific":{"extracted_events":[{"introduced":"26.07.0"},{"last_affected":"26.07.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["26.07.0","abi-16.22","v26.07.0"],"database_specific":{"vanir_signatures_modified":"2026-09-17T08:02:16Z","vanir_signatures":[{"source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"function":"gf_node_replace","file":"src/scenegraph/base_scenegraph.c"},"deprecated":false,"digest":{"function_hash":"60823540465400110655145389395242055259","length":1625},"id":"CVE-2026-90824-062a9f7a","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-90824-24717d3b","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_bt.c"},"deprecated":false,"digest":{"line_hashes":["290805028101592447850845285813473353912","118396174820326425799868880572086606749","205156296132713970872926628230661658458","232696690050175471801017822637085370652"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"48295756588153345846283589256339961369","length":1063},"id":"CVE-2026-90824-2fce2885","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/dom_events.c","function":"gf_sg_dom_event_bubble"}},{"source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"function":"gf_node_activate_ex","file":"src/scenegraph/base_scenegraph.c"},"deprecated":false,"digest":{"length":932,"function_hash":"111472608253496325668016521900531202841"},"id":"CVE-2026-90824-30aae47a","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["33535434379441107037801626008864371709","159585290357705810194625383024322853013","332049873830475796628664114894732386156","194672398426588307647002716514358122230","177628327203484033563175207322869312709","224087343089186192921951965396529477935","91061689785927719676524819041130164345","104221026717868621152718163374627763641","42039298485788565342098205845886844335","110379387274143147120796664852142850941","59953391991428273092807664402671492156","57603539527938279146505859107605267175","42039298485788565342098205845886844335","154621877059020004615861418389674813304","330445446597699485566449214344896001290","71742309449079582188321612957072168992","116882259292260585881095466107216695552","91064336316882693477205687267082223798","254775438788570861343963625217009322814","266469855011855358171217527292980500715","53002559633163494250281185758936543721","239381356093102399942306617733615050677","325912465387707972048592288769009670655","216957615859300988380300661381352839544","116882259292260585881095466107216695552","160764056992731141793265607138111267106","126092901300084223107667920214337179297","255323075389552300519356011387551034482","248560834472668807607320294080161925382","188894141873960348193285174768476504490","12096911676082240895768200601660212440","72831441313465427429398167009422230727"],"threshold":0.9},"id":"CVE-2026-90824-819a9d78","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_xmt.c"},"deprecated":false},{"source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"drop_nested_node_codes"},"deprecated":false,"digest":{"function_hash":"133603431258404249199478378209834894260","length":737},"id":"CVE-2026-90824-83b51898","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":110,"function_hash":"182192286411857883145960891710278734230"},"id":"CVE-2026-90824-84cced62","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_deactivate"}},{"digest":{"function_hash":"92632358225579962734539177075374098988","length":2423},"id":"CVE-2026-90824-9af0249e","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/laser/lsr_dec.c","function":"lsr_read_update_value_indexed"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c"},"deprecated":false,"digest":{"line_hashes":["298363963436022910951384398303170359813","263958099654079038671410279998868817916","221712343103980599506176189968370941874","1811305617094904268931071448910206100","17716454557899848392947374838533412912","312938282881100231873841259510374313216","8371149100337224364363570804269447603","147572700251097819989436978039265364469","17716454557899848392947374838533412912","312938282881100231873841259510374313216","8371149100337224364363570804269447603","147572700251097819989436978039265364469","94148467772358404230049652635077794002","265125240816984630206103563080898184418","233258248960968133511026627021536445669","36174458635597334595690785778131864224","187712270543344129650957838180698566908","609795640236965633520302898605553368","70101880774951410624145669636431689307","263251361831523669053383922791487572713","315725810552011504943424814666832087168","33488757642595701608746615323777475639","40802741994595458557254287816246593758","189784792298608615033136889693770904336","271849138611733325642366693669574151556","43057786332087092050327154261746014765","250120720102211024914796272264972483939","244724294594863251404552372606904566276","38817009236350840354039571032803871850","305860801812951744451805911104893093078","290802512245772158032800083894548588673","153531306846077242953417157950044327088","110083060213255789210669471818241850655","241612033558683106549584231807053575423","266655236844373721974718198792599548690","175843163322317821260565774748454181208","78352989259744833041369157028608679520","143399172548102719628974956877688967189","308147029221184621470327074234035008013","82777804884761666958922187858634598724","91495942980445202911241468629093478502","74092613649866161099243486039154768284","315542626976915611010003859278675678974","259813186936068947944009852955732049698","264009915150559088249681276031939215166","159008447843615840818259452110526710415","308862430777485748650155555831045857018","191911128407246892546245373756450451963","144572809137389134106558223431437114500","41246252382559663346718470603630451269","38355862390314445857055377332156808761","316779693996579679320634979245370342970","266362891694565734068471988753333433699"],"threshold":0.9},"id":"CVE-2026-90824-a1ef1f7c","signature_type":"Line"},{"source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_deactivate_ex"},"deprecated":false,"digest":{"function_hash":"287490260030873094742750284112165069131","length":926},"id":"CVE-2026-90824-aa92778b","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"61055651731110483685083098806188812387","length":14177},"id":"CVE-2026-90824-b04b42a0","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_xmt.c","function":"xmt_parse_element"}},{"source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/laser/lsr_dec.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["111779016251385522113390407980766881022","209494205099354379610664033756563557348","134118702025223334426368072823156242713","171360718430283626688832168216719134241"]},"id":"CVE-2026-90824-bee190ba","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"213403102856437142217802338412056761467","length":15849},"id":"CVE-2026-90824-bf6d5d2e","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_xmt.c","function":"xmt_node_end"}},{"source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scenegraph/dom_events.c"},"deprecated":false,"digest":{"line_hashes":["177336444113191033645870606383339089864","213881210304715484440118202660713272870","275247316176001247492980742696928597700","223602979893202094053316637539285781747"],"threshold":0.9},"id":"CVE-2026-90824-c0da866c","signature_type":"Line","signature_version":"v1"},{"target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_activate"},"deprecated":false,"digest":{"length":142,"function_hash":"88947420348595128248442035226277348163"},"id":"CVE-2026-90824-c128f506","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24"},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24","target":{"file":"src/scene_manager/loader_bt.c","function":"gf_bt_sf_node"},"deprecated":false,"digest":{"function_hash":"327329031742340762859969448033885001013","length":7568},"id":"CVE-2026-90824-f5035a80","signature_type":"Function"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90824.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}