OCTOBER 13, 2026
Live Feed
Back to database
Case File

CVE-2026-92472

LOW · CVSS 3.3 EPSS 0.17% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

A vulnerability exists in the GPAC MP4Box component, specifically in the gf_node_deactivate_ex function, which can lead to a use-after-free condition when manipulated. This issue requires local exploitation and has been publicly disclosed, making it a potential risk for systems running affected versions. Organizations using GPAC should prioritize upgrading to version abi-16.24 to mitigate this vulnerability.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit
GitHub PoC Links
github.com ↗ github.com ↗ github.com ↗ github.com ↗ github.com ↗

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-92472
Severity
LOW
CVSS
3.3
EPSS
0.17%

Original NVD Description

A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.