CVE-2026-90827: GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free

Published Sep 14, 2026

Updated

A vulnerability was identified in GPAC 26.07.0. This affects the function gfnodedeactivateex of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is able to mitigate this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Affected Software

1 affected component

Gpac MP4Box=26.07.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GPAC MP4Box to a version that resolves this vulnerability.
Fixed in abi-16.23Patch 49dee5cad329cfed310c1682703df7daa47df31a

Event History

Sep 14, 2026

CVE Published

via MITRE·09:45 PM

Data Sourced

via MITRE·09:45 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

The issue affects GPAC MP4Box 26.07.0. Exploitation requires local access and low privileges, so remotely reachable exposure is not indicated by the available data.

What capabilities does an attacker need?

An attacker needs local access and low-level privileges. No user interaction is required, and public exploit code is reported to be available.

What is the recommended remediation?

Upgrade the affected component to version abi-16.23. The identified patch is 49dee5cad329cfed310c1682703df7daa47df31a.