CVE-2026-90792Medium· 4.3▾ TwilightPoC availableA flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereferen…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.4%
A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-90573Low· 3.3A vulnerability was identified in GPAC up to f1219cde
CVE-2026-90576Low· 3.3A security vulnerability has been detected in GPAC up to f1219cde
CVE-2026-90609Low· 3.3A vulnerability has been found in GPAC up to f1219cde
CVE-2026-91088Medium· 4.8A vulnerability has been found in GPAC up to f1219cde
CVE-2026-91086Medium· 6.3A security vulnerability has been detected in GPAC up to f1219cde
CVE-2026-90826Low· 2.8A vulnerability was determined in GPAC 26.07.0