CVE-2026-91088
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in GPAC up to f1219cde affects the function gf_url_concatenate_ex in utils/url.c, leading to a heap-based buffer overflow. The attack must be approached locally. Upgrading to version abi-16.23 is recommended to address the issue.
Risk Assessment
The risk includes local buffer overflow, which could lead to memory corruption and potential code execution by a local attacker, compromising system integrity.
Recommendation
It is recommended to upgrade GPAC to version abi-16.23 or later, which includes a fix. Also restrict local access to systems using GPAC.
Other vulnerabilities in GPAC
See all- CVE-2026-92474Low
A security flaw was discovered in GPAC 26.08-DEV affecting the function gf_inline_get_proto_lib in src/compositor/mpeg4_inline.c (Proto Link Handler component). The manipulation results in a use-after-free condition, and the attack requires local access. The exploit has been publicly released and may be used for attacks.
- CVE-2026-92472Low
A vulnerability was determined in GPAC 26.08-DEV affecting the function gf_node_deactivate_ex in src/scenegraph/base_scenegraph.c (MP4Box component). Executing a manipulation can lead to a use-after-free condition, and the attack requires local access. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-15185Low
A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.
- CVE-2025-70307High
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70308High
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
- CVE-2025-70304High
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70298High
GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.
- CVE-2026-88339Medium
A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.
- CVE-2026-93331High
A vulnerability was identified in GPAC 26.08-DEV affecting the function gf_rtp_parse_ttxt in src/ietf/rtp_depacketizer.c of the RTP Depacketizer component. Manipulation of the size argument leads to an out-of-bounds read. The attack can be launched remotely.
- CVE-2026-92475Medium
A weakness has been identified in GPAC 26.08-DEV affecting the function wait_for_header_and_parse of the file src/utils/downloader.c. Manipulation of the Content-Range argument causes an out-of-bounds read. The attack requires local access, and the exploit has been made publicly available and could be used for attacks. Upgrading to version abi-16.26 fixes this issue (patch name: c74a3065038ede35c1c7b75fa493a69ef6bcdb84).
Original NVD description (English source)
A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the component URL Handler. The manipulation leads to heap-based buffer overflow. An attack has to be approached locally. Upgrading to version abi-16.23 is capable of addressing this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. It is advisable to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS