SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-91089

MEDIUM · CVSS 6.3 EPSS 0.29% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-15 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

The vulnerability affects GPAC versions up to f1219cde, specifically in the gf_node_get_name_and_id function within the scenegraph/base_scenegraph.c file, leading to a use-after-free condition. This flaw can be exploited remotely, potentially allowing attackers to execute arbitrary code. Organizations using GPAC should prioritize upgrading to version abi-16.23 to mitigate the risk associated with this publicly disclosed exploit.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-91089
Severity
MEDIUM
CVSS
6.3
EPSS
0.29%

Original NVD Description

A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c. The manipulation results in use after free. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version abi-16.23 is recommended to address this issue. The patch is identified as 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.