CVE-2026-92472: GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gfnodedeactivateex of the file src/scenegraph/basescenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Boxto a version that resolves this vulnerability.Fixed in abi-16.24Patch e34f4ba349d55cd1849f0bcf4cf46552732e2db7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running the affected GPAC MP4Box component are exposed when a local attacker has the required low-level privileges. The attack vector is local; the provided data does not indicate remote exploitation.
What access does an attacker need?
An attacker must be able to launch the attack locally and have low privileges. No user interaction is required.
Is exploit code available?
Yes. The exploit has been publicly disclosed and may be used.
What should be done to remediate the issue?
Upgrade the affected component to version abi-16.24 or later. The listed fix is patch e34f4ba349d55cd1849f0bcf4cf46552732e2db7.