CVE-2026-108539CWE-119CWE-416

CVE-2026-108539

Medium · published October 11, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
21.6
In the wild
Unconfirmed
What it is

A vulnerability was detected in GPAC up to 26.07.0. This affects the function gf_fq_pop of the file filter_core/filter_queue.c of the component MP4Box. Performing a manipulation results in use after free. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00301 · 21.6th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-416 · Use After Free
Published
2026-10-11T09:16Z
References (5)
https://github.com/user-attachments/files/31288202/PoC.zip · [email protected]https://vuldb.com/cve/CVE-2026-108539 · [email protected]https://vuldb.com/submit/941995 · [email protected]https://vuldb.com/vuln/416194 · [email protected]https://vuldb.com/vuln/416194/cti · [email protected]
EPSS history
Timeline
  • 12 OCT 03:26Z
    EPSS moved — → 0%
    epss
  • 11 OCT 05:00Z
    GPAC MP4Box filter_queue.c gf_fq_pop use after free
    cvelistv5
  • 11 OCT 05:00Z
    GPAC MP4Box filter_queue.c gf_fq_pop use after free
    cvelistv5