SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-91090

LOW · CVSS 3.9 EPSS 0.12% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-15 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

A stack-based buffer overflow vulnerability exists in the gf_node_activate_ex function of GPAC, affecting versions up to f1219cde, which can be exploited locally. Although the severity is rated low, the public disclosure of the exploit means that users should prioritize upgrading to version abi-16.23 to mitigate potential risks. Organizations using GPAC should ensure they apply the patch to safeguard against this vulnerability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-91090
Severity
LOW
CVSS
3.9
EPSS
0.12%

Original NVD Description

A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.