CVE-2026-90824
Low · CVSS 1.9Published 2026-09-14
CVSS
1.9
Low
EPSS
—
exploit probability
Active Exploit
No
not yet listed
What is CVE-2026-90824?
A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
CVSS Score Explained
CVSS 1.9 is Low severity. Impact is limited and exploitation is difficult. Patch when convenient.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://github.com/gpac/gpac/
- ›https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24
- ›https://github.com/gpac/gpac/issues/3804
- PATCHhttps://github.com/gpac/gpac/releases/tag/abi-16.23
- PoChttps://github.com/user-attachments/files/30398880/poc_08_add.zip
- ›https://vuldb.com/cve/CVE-2026-90824
- ›https://vuldb.com/submit/914949
- ›https://vuldb.com/vuln/403326
- ›https://vuldb.com/vuln/403326/cti
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-91197Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() that fails to disable external entity resolution when parsing deployed BPMN resources. Attackers with process deployment privileges can embed DOCTYPE declarations with external entities in BPMN files to read arbitrary local files or trigger requests to internal network endpoints when diagram layout is computed.7.1
- CVE-2026-91198GrowthBook through 5.0.1 returns unredacted fact table definitions including raw warehouse SQL in payloads served by unauthenticated public report and experiment endpoints. Attackers with knowledge of a publicly shared report or experiment identifier can read internal data warehouse query text, schema, table names, filter values and datasource identifiers.6.9
- CVE-2026-91199Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-local addresses including cloud metadata services to read page titles and descriptions of internal resources.5.3
- CVE-2026-91200DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.8.7
- CVE-2026-91201DocsGPT through 0.20.0 posts OAuth connector session tokens to a wildcard target origin in the callback-status endpoint without validating sender origin. Attackers can obtain session tokens and provider account emails by acting as window.opener during OAuth authorization, then use tokens to disconnect victims' cloud storage connectors.5.3
- CVE-2026-90829A weakness has been identified in GNU Binutils 2.47. This issue affects the function bfd_elf_set_group_contents of the file bfd/elf.c of the component SHT_GROUP Section Handler. Executing a manipulation can lead to null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through a bug report but has not responded yet.1.9