What is CVE-2026-90687?

CVE-2026-90687 is a medium-severity vulnerability in Gpac, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.3/10. Published 2026-09-14.

How severe is CVE-2026-90687?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Buffer overflow in Gpac

CVE-2026-90687

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

Vulnerability class: Buffer Overflow

EPSS: 0.003 (21.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.

Affected products

N/a Gpac — versions f1219cde

Weakness classification (CWE)

References

cna@vuldb.com (technical-description, vdb-entry)
cna@vuldb.com (signature, permissions-required)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (third-party-advisory)
cna@vuldb.com (issue-tracking)
cna@vuldb.com (exploit)
cna@vuldb.com (patch)
cna@vuldb.com (patch)
cna@vuldb.com (product)

Frequently asked questions

What is CVE-2026-90687?: CVE-2026-90687 is a medium-severity vulnerability in Gpac, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.3/10. Published 2026-09-14.
How severe is CVE-2026-90687?: Medium severity. CVSS v3 base score is 6.3 out of 10.