CVE-2026-90792CWE-404CWE-476

CVE-2026-90792

Medium · published September 14, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
52.2
In the wild
Unconfirmed
What it is

A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00688 · 52.2th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2026-09-14T20:17Z
References (9)
https://github.com/Ech06/CVE_submit/blob/main/gpac_3802.md · [email protected]https://github.com/gpac/gpac/ · [email protected]https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975 · [email protected]https://github.com/gpac/gpac/issues/3802 · [email protected]https://github.com/gpac/gpac/releases/tag/abi-16.23 · [email protected]https://vuldb.com/cve/CVE-2026-90792 · [email protected]https://vuldb.com/submit/914123 · [email protected]https://vuldb.com/vuln/403298 · [email protected]https://vuldb.com/vuln/403298/cti · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 15:00Z
    GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
    cvelistv5