CVE-2026-91087

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.

• CWE-119
• CWE-416

• https://github.com/gpac/gpac/
• https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7
• https://github.com/gpac/gpac/issues/3807
• https://github.com/gpac/gpac/releases/tag/abi-16.24
• https://github.com/user-attachments/files/30399593/poc_12_info.zip
• https://vuldb.com/cve/CVE-2026-91087
• https://vuldb.com/submit/919756
• https://vuldb.com/vuln/403649
• https://vuldb.com/vuln/403649/cti

Published

Sep 15, 2026

Last Modified

Sep 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9107The Kali Forms — Contact Form & Drag-and-Drop Builder plugin…6.4
• CVE-2026-91079Huly Platform through 0.7.426 contains a server-side request…8.5
• CVE-2026-9108A path traversal security issue exists within Studio 5000 Lo…7.5
• CVE-2026-91080webhook through 2.8.3 reads the entire request body into mem…7.5
• CVE-2026-91081Docs through 5.6.1 contains a server-side request forgery vu…5.8
• CVE-2026-91086A security vulnerability has been detected in GPAC up to f12…6.3
• CVE-2026-91088A vulnerability has been found in GPAC up to f1219cde. This …4.8
• CVE-2026-91089A vulnerability was found in GPAC up to f1219cde. Impacted i…6.3
• CVE-2026-9109The GPTranslate – Multilingual AI Translation for WordPress:…7.2
• CVE-2026-91090A vulnerability was determined in GPAC up to f1219cde. The a…3.9
• CVE-2026-91091A vulnerability was identified in GPAC up to f1219cde. The i…4.3
• CVE-2026-9110Inappropriate implementation in UI in Google Chrome on Windo…4.2