Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV L L N L N N N L 1.9 .0018 7.0 —
AFFECTED Product Versions Fixed GPAC 26.07.0 – abi-16.23
TIMELINE Sep 13 Reserved by VulDB Sep 14 Published (CNA: VulDB) Sep 15 EXPLOIT PUBLISHED — CVE-2026-90824 (GPAC). Public exploit reference added.
A vulnerability has been found in GPAC 26.07.0. Affected is the function gf_sg_dom_event_bubble of the file src/scenegraph/dom_events.c of the component MP4Box. The manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is able to address this issue. The identifier of the patch is 9eb40df4448b88d6a6ce3454657c06f47eff0b24. It is recommended to upgrade the affected component.
| Date | Event | Detail |
|---|---|---|
| September 13, 2026 | Reserved | Reserved by VulDB |
| September 14, 2026 | Published | Published (CNA: VulDB) |
| September 15, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-90824 (GPAC). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | GPAC | — | 26.07.0 | abi-16.23 |
Authoritative record: CVE-2026-90824 at cve.org
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-90824 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
