Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-92474: GPAC 26.08‑DEV can be crashed by local users

CVE-2026-92474 · published 1 month ago

Summary

The GPAC multimedia library version 26.08‑DEV contains a coding error that can cause the program to stop working when a local user sends specially crafted data. This may let an attacker cause the application to crash or potentially run code. Updating GPAC to version abi‑16.24 (or later) fixes the problem, so apply the update as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	–	gpac	26.08-DEV
Ubuntu:Pro:14.04:LTS	canonical	gpac	All versions

Original advisory text

GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free

A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of the file src/compositor/mpeg4_inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.24 mitigates this issue. The patch is identified as e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is recommended.

References

https://github.com/gpac/gpac/ URL
https://vuldb.com/cve/CVE-2026-92474 Vendor Advisory
https://github.com/gpac/gpac/issues/3829 Third Party Advisory
https://github.com/gpac/gpac/commit/e34f4ba349d55cd1849f0bcf4cf46552732e2db7 Patch
https://ubuntu.com/security/CVE-2026-92474 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-92474 Third Party Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92474... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-92474 Vendor Advisory
https://github.com/gpac/gpac/releases/tag/abi-16.24 Patch
https://github.com/user-attachments/files/30635900/poc_01.zip Exploit
https://vuldb.com/submit/941005 Vendor Advisory
https://vuldb.com/vuln/405733 Vendor Advisory
https://vuldb.com/vuln/405733/cti Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

CWE-119Buffer Overflow

Timeline

Published16 Sep 2026

Updated26 Oct 2026

First seen16 Sep 2026

Sources

CVE-2026-92474 · NVD

CVE-2026-92474 · MITRE

UBUNTU-CVE-2026-92474 · OSV

CVE-2026-92474 · OSV

Track software like this

Free during beta