Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

Buy Us a Coffee

CVE-2026-91089— GPAC base_scenegraph.c gf_node_get_name_and_id use after free

Quick assessment

Affected

n/a GPAC

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 GPAC（版本号 up to f1219cde）中发现一个漏洞。受影响的函数是文件中的。该问题由对已释放内存的再次使用（use-after-free）引起，且攻击者可通过网络远程触发。该漏洞的利用代码已经公开，存在被实际利用的风险。建议升级到版本 abi-16.23 以修复此问题。对应的补丁标识为 49dee5cad329cfed310c1682703df7daa47df31a。请升级受影响的组件。

CVSS 6.3 · Medium Updated Sep 15, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1190.001

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GPAC base_scenegraph.c gf_node_get_name_and_id use after free

Source: CVE Program / CVE List V5

Vulnerability Description

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is recommended to address this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
-	GPAC	f1219cde	`cpe:2.3:a:gpac:gpac::::::::`

II. Public POCs for CVE-2026-91089

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-91089

请登录查看更多情报信息。

Same Patch Batch · n/a · 2026-09-15 · 6 CVEs total

CVE-2026-91087	7.3 HIGH	GPAC Compositor media_object.c gf_mo_get_od_id use after free
CVE-2026-91086	6.3 MEDIUM	GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow
CVE-2026-91088	4.8 MEDIUM	GPAC URL url.c gf_url_concatenate_ex heap-based overflow
CVE-2026-91091	4.3 MEDIUM	GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption
CVE-2026-91090	3.9 LOW	GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow

IV. Related Vulnerabilities

Same product: GPAC

Same vendor: n/a

Same weakness: CWE-416

V. Comments for CVE-2026-91089

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-91089— GPAC base_scenegraph.c gf_node_get_name_and_id use after free

Quick assessment

Possible ATT&CK Techniques 2 AI

I. Basic Information for CVE-2026-91089

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-91089

III. Intelligence Information for CVE-2026-91089

Patches & Fixes for CVE-2026-91089 (1)

Vendor Pages for CVE-2026-91089 (1)

Other References for CVE-2026-91089 (1)

Other References for CVE-2026-91089 (1)

Same Patch Batch · n/a · 2026-09-15 · 6 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-91089

Leave a comment