Description
A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a GPAC
26.07.0affectedabi-16.23unaffected
References
- https://vuldb.com/vuln/403326 ↗
- https://vuldb.com/vuln/403326/cti ↗
- https://vuldb.com/cve/CVE-2026-90824 ↗
- https://vuldb.com/submit/914949 ↗
- https://github.com/gpac/gpac/issues/3804 ↗
- https://github.com/user-attachments/files/30398880/poc_08_add.zip ↗
- https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24 ↗
- https://github.com/gpac/gpac/releases/tag/abi-16.23 ↗
- https://github.com/gpac/gpac/ ↗