CVE-2026-91090

A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded.

• CWE-119
• CWE-121

• https://github.com/gpac/gpac/
• https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24
• https://github.com/gpac/gpac/issues/3810
• https://github.com/gpac/gpac/releases/tag/abi-16.23
• https://github.com/user-attachments/files/30399928/poc_17_nstatx.zip
• https://vuldb.com/cve/CVE-2026-91090
• https://vuldb.com/submit/919759
• https://vuldb.com/vuln/403652
• https://vuldb.com/vuln/403652/cti

Published

Sep 15, 2026

Last Modified

Sep 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-91085Apache Karaf's shell/SSH command security is enforced by per…6.3
• CVE-2026-91086A security vulnerability has been detected in GPAC up to f12…6.3
• CVE-2026-91087A flaw has been found in GPAC up to f1219cde. This vulnerabi…7.3
• CVE-2026-91088A vulnerability has been found in GPAC up to f1219cde. This …4.8
• CVE-2026-91089A vulnerability was found in GPAC up to f1219cde. Impacted i…6.3
• CVE-2026-9109The GPTranslate – Multilingual AI Translation for WordPress:…7.2
• CVE-2026-91091A vulnerability was identified in GPAC up to f1219cde. The i…4.3
• CVE-2026-91092The wpForo Forum plugin for WordPress is vulnerable to autho…4.3
• CVE-2026-91093A potential security vulnerability has been identified in HP…8.5
• CVE-2026-91095In proxygen from v2024.10.28.00 until v2026.09.28.00, the HT…5.3
• CVE-2026-91096In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTra…7.5
• CVE-2026-91097HP has identified and remediated multiple externally reporte…9.8