Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-91087— GPAC Compositor media_object.c gf_mo_get_od_id use after free

Quick assessment

Affected

n/a GPAC

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GPAC 的 commit f1219cde 之前发现了一个缺陷。该漏洞影响 Compositor 组件中文件里的函数。执行特定操作可能导致“释放后使用”（Use-After-Free）问题。攻击者可以从远程发起攻击。该漏洞的利用方式已被公开，可能会被实际利用。升级到版本 abi-16.24 可以解决此问题，对应的补丁号为 e34f4ba349d55cd1849f0bcf4cf46552732e2db7。建议升级受影响的组件。

CVSS 7.3 · High Updated Sep 15, 2026

Possible ATT&CK Techniques 2 AI

T1195 · Supply Chain Compromise T1204 · User Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GPAC Compositor media_object.c gf_mo_get_od_id use after free

Source: CVE Program / CVE List V5

Vulnerability Description

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	GPAC	f1219cde	`cpe:2.3:a:gpac:gpac::::::::`

II. Public POCs for CVE-2026-91087

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-91087

请登录查看更多情报信息。

Same Patch Batch · n/a · 2026-09-15 · 6 CVEs total

CVE-2026-91089	6.3 MEDIUM	GPAC base_scenegraph.c gf_node_get_name_and_id use after free
CVE-2026-91086	6.3 MEDIUM	GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow
CVE-2026-91088	4.8 MEDIUM	GPAC URL url.c gf_url_concatenate_ex heap-based overflow
CVE-2026-91091	4.3 MEDIUM	GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption
CVE-2026-91090	3.9 LOW	GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow

IV. Related Vulnerabilities

Same product: GPAC

Same vendor: n/a

Same weakness: CWE-416

V. Comments for CVE-2026-91087

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-91087— GPAC Compositor media_object.c gf_mo_get_od_id use after free

Quick assessment

Possible ATT&CK Techniques 2 AI

I. Basic Information for CVE-2026-91087

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-91087

III. Intelligence Information for CVE-2026-91087

Patches & Fixes for CVE-2026-91087 (1)

Proof of Concept for CVE-2026-91087 (1)

Vendor Pages for CVE-2026-91087 (1)

Other References for CVE-2026-91087 (1)

Same Patch Batch · n/a · 2026-09-15 · 6 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-91087

Leave a comment