CVE-2026-92472 PUBLISHED

A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base_scenegraph.c of the component MP4Box. Executing a manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.24 is sufficient to fix this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. The affected component should be upgraded. This issue is distinct from CVE-2026-90827.

• fczhang (VulDB User) reporter

• VDB-405731 | GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
• VDB-405731 | CTI Indicators (IOB, IOC, IOA)
• CVE-2026-92472 | CVE Analysis and Report
• Submit #941003 | GPAC GPAC MP4Box GPAC 26.08-DEV / master commit 49dee5cad329cfed310c1682703df7daa47df31a: Heap Use-After-Free via Uncontrolled Recursion
• https://github.com/gpac/gpac/issues/3831
• https://github.com/user-attachments/files/30635912/poc_12.zip
• https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7
• https://github.com/gpac/gpac/releases/tag/abi-16.24
• https://github.com/gpac/gpac/

• Use After Free CWE
• Memory Corruption CWE