CVE-2026-91087: GPAC Compositor media_object.c gf_mo_get_od_id use after free
A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gfmogetodid of the file compositor/mediaobject.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC Compositorto a version that resolves this vulnerability.Fixed in abi-16.24Patch e34f4ba349d55cd1849f0bcf4cf46552732e2db7
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
GPAC Compositor deployments using versions up to commit f1219cde are affected. The issue is remotely exploitable and requires no privileges or user interaction according to the supplied severity vector.
What does an attacker need to exploit the vulnerability?
An attacker can perform the attack remotely by supplying a manipulation that reaches gf_mo_get_od_id in compositor/media_object.c. The attack complexity is rated low, and public exploit code has been published.
How should affected systems be remediated?
Upgrade the affected GPAC component to version abi-16.24. The fix is identified as patch e34f4ba349d55cd1849f0bcf4cf46552732e2db7.