CVE-2026-91087: GPAC Compositor Use After Free Vulnerability

CVE-2026-91087 Overview

CVE-2026-91087 is a use-after-free vulnerability in the GPAC multimedia framework affecting builds up to commit f1219cde. The flaw resides in the gf_mo_get_od_id function within compositor/media_object.c of the Compositor component. An attacker can trigger the condition remotely by supplying crafted media input, leading to memory corruption. A public proof-of-concept has been published, increasing the likelihood of exploitation attempts against vulnerable installations. The issue is tracked under [CWE-119] and has been resolved in GPAC release abi-16.24 via patch commit e34f4ba349d55cd1849f0bcf4cf46552732e2db7.

Critical Impact
Successful exploitation can cause memory corruption in the GPAC Compositor, enabling denial of service or potential arbitrary code execution when processing malicious media content.

Affected Products

GPAC multimedia framework versions up to commit f1219cde
GPAC Compositor component (compositor/media_object.c)
Downstream applications embedding vulnerable GPAC builds

Discovery Timeline

2026-09-15 - CVE-2026-91087 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-91087

Vulnerability Analysis

The vulnerability is a use-after-free condition in the GPAC Compositor. When gf_mo_get_od_id is invoked on a media object whose backing memory has already been released, the function dereferences a stale pointer. Attackers can influence object lifetimes through crafted scene graph commands or malformed media streams processed by the compositor pipeline.

GPAC is widely deployed as a library and as command-line tools (MP4Box, gpac) for MP4, LASeR, and BIFS content. Because parsing occurs before validation of scene graph node references, the flaw is reachable during normal media processing. The classification under [CWE-119] reflects improper restriction of operations within memory buffer bounds.

Root Cause

The underlying defect involves scene graph command resolution that reuses a node pointer without accounting for prior deactivation or removal. Related fixes in the patch harden gf_sg_command_set_node usage and preserve deactivation state before mutating flags, indicating multiple lifetime tracking gaps in the scene graph and compositor subsystems.

Attack Vector

Exploitation is remote when GPAC processes attacker-controlled media (for example, a downloaded MP4 or streamed LASeR scene). No authentication or user interaction beyond opening the media is required. A public PoC bundle is referenced from the upstream issue tracker, lowering the barrier to weaponization.

// Patch excerpt: src/laser/lsr_dec.c - safer node resolution
for (i=0; i<gf_list_count(codec->unresolved_commands); i++) {
    GF_Command *com = (GF_Command *)gf_list_get(codec->unresolved_commands, i);
    gf_assert(!com->node);
-   com->node = gf_sg_find_node(codec->sg, com->RouteID);
-   if (com->node) {
+   GF_Node *n = gf_sg_find_node(codec->sg, com->RouteID);
+   if (n) {
+       gf_sg_command_set_node(com, n);
        gf_node_register(com->node, NULL);
        com->RouteID = 0;
        gf_list_rem(codec->unresolved_commands, i);

Source: GitHub Commit e34f4ba349d5. The patch replaces direct pointer assignment with gf_sg_command_set_node, which manages reference tracking to prevent stale pointer reuse.

// Patch excerpt: src/scenegraph/base_scenegraph.c - preserve deactivation state
GF_ChildNodeItem *item;
+Bool was_deactivated;
/*avoid stack overflow on cyclic/malformed scene graphs*/
if (depth > 255) return GF_OK;
if (node->sgprivate->tag<GF_NODE_FIRST_DOM_NODE_TAG) return GF_BAD_PARAM;
-if (! (node->sgprivate->flags & GF_NODE_IS_DEACTIVATED)) {
+
+was_deactivated = (node->sgprivate->flags & GF_NODE_IS_DEACTIVATED) ? GF_TRUE : GF_FALSE;
+
+if (!was_deactivated) {
    node->sgprivate->flags |= GF_NODE_IS_DEACTIVATED;

Source: GitHub Commit e34f4ba349d5.

Detection Methods for CVE-2026-91087

Indicators of Compromise

Unexpected crashes or segmentation faults in gpac, MP4Box, or applications linking libgpac when parsing untrusted media.
Presence of GPAC binaries built from commits at or before f1219cde on production systems.
Media files matching the PoC artifacts referenced in GitHub Issue #3807.

Detection Strategies

Inventory installed GPAC versions and compare against release abi-16.24 using package managers or MP4Box -version.
Enable AddressSanitizer or Valgrind on media processing pipelines in test environments to surface use-after-free conditions.
Monitor process telemetry for repeated crashes of media handlers correlated with inbound file uploads.

Monitoring Recommendations

Log and alert on crash dumps from processes hosting libgpac and forward them to a central analytics platform for triage.
Track file provenance for media content submitted to servers that transcode or preview with GPAC.
Baseline normal compositor CPU and memory behavior to detect anomalous processing spikes triggered by malformed input.

How to Mitigate CVE-2026-91087

Immediate Actions Required

Upgrade GPAC to release abi-16.24 or later on all endpoints, servers, and container images.
Rebuild and redistribute any internal software that statically links libgpac against a patched version.
Restrict processing of untrusted media in vulnerable GPAC installations until patching completes.

Patch Information

The fix is committed as e34f4ba349d55cd1849f0bcf4cf46552732e2db7 and shipped in GitHub Release abi-16.24. Refer to the GitHub Commit e34f4ba349d5 for the source-level changes and to VulDB CVE-2026-91087 for tracking metadata.

Workarounds

Disable GPAC-based media preview or transcoding for content from untrusted sources.
Sandbox GPAC execution using seccomp, AppArmor, or containers with read-only filesystems and dropped capabilities.
Apply file-type allowlists at ingress to reject scene graph formats not required by the application.

bash

# Verify installed GPAC version and upgrade path
MP4Box -version 2>&1 | head -n 1

# Build patched GPAC from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.24
./configure && make -j"$(nproc)" && sudo make install