CVE-2026-91091: GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption
A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfnodelistinsertchild of the file scenegraph/basescenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC (Node Insertion) gf_node_list_insert_child in scenegraph/base_scenegraph.cto a version that resolves this vulnerability.Fixed in abi-16.23Patch 49dee5cad329cfed310c1682703df7daa47df31a
Event History
Frequently Asked Questions
Which versions should be treated as affected?
GPAC versions up to commit f1219cde are affected. Upgrading to version abi-16.23 resolves the issue.
Does exploitation require authentication or local access?
The vulnerability can be exploited remotely and does not require privileges. User interaction is required according to the supplied severity vector.
Is exploit code available?
Yes. The exploit is publicly available and may be used by attackers.
What should be done if the deployment cannot be upgraded immediately?
The provided information only identifies upgrading to abi-16.23 as the remediation. The referenced fix is patch 49dee5cad329cfed310c1682703df7daa47df31a.