CVE-2026-91091 MEDIUM

CVE-2026-91091: GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption

Vendor N/A

Product GPAC

Weakness CWE-119

Published September 15, 2026

Last update September 15, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

Key dates

02Disclosure timeline

September 15, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-91091 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/119.html AskarLabs — CWE-119 write-up Improper Restriction of Operations within Memory Buffer