CVE-2026-90578 - GPAC MP4Box list.c gf_list_count use after free
Brief
CVE ID : CVE-2026-90578
Published : Sept. 13, 2026, 7:16 p. m.
- 1 hour, 36 minutes ago
Description : A flaw has been found in GPAC up to f1219cde. Affected by this issue is the function gf_list_count of the file utils/list. c of the component MP4Box. Executing a manipulation can lead to use after free. The attack is restricted to local execution. The exploit has been published and may be used. Upgrading to version abi-16. 23 can resolve this issue.
This patch is called 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
Severity: 5.3
- MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...