A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Gpac
  • Gpac

No data.

No data.

References
Link Providers
https://github.com/gpac/gpac/ cve-icon cve-icon
https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24 cve-icon cve-icon
https://github.com/gpac/gpac/issues/3810 cve-icon cve-icon
https://github.com/gpac/gpac/releases/tag/abi-16.23 cve-icon cve-icon
https://github.com/user-attachments/files/30399928/poc_17_nstatx.zip cve-icon cve-icon
https://vuldb.com/cve/CVE-2026-91090 cve-icon cve-icon
https://vuldb.com/submit/919759 cve-icon cve-icon
https://vuldb.com/vuln/403652 cve-icon cve-icon
https://vuldb.com/vuln/403652/cti cve-icon cve-icon
History

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 07:45:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.
Title GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 3.2, 'vector': 'AV:L/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.9, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.9, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 2.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-15T07:30:09.351Z

Updated: 2026-09-17T13:59:51.515Z

Reserved: 2026-09-14T18:00:01.604Z

Link: CVE-2026-91090

cve-icon Vulnrichment

Updated: 2026-09-17T13:59:47.421Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T08:17:06.807

Modified: 2026-09-17T14:17:53.157

Link: CVE-2026-91090

cve-icon Redhat

No data.