CVE-2026-90685

Publié : 14 septembre 2026

Modifié : 14 septembre 2026

Score CVSS

2.8

LOW

Description détaillée

A vulnerability has been found in GPAC up to f1219cde. Affected by this issue is the function lsr_exec_command_list of the file laser/lsr_dec.c of the component MP4Box. The manipulation leads to reachable assertion. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 can resolve this issue. The identifier of the patch is afca1f1181668d85941d51ed1adf647807d5d975. The affected component should be upgraded.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Références et Patchs

https://github.com/gpac/gpac/https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975 https://github.com/gpac/gpac/issues/3825 https://github.com/gpac/gpac/releases/tag/abi-16.23 https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln%20GPAC%20MP4Box%20Assertion%20Failure%20assert(!codec-bs).md https://vuldb.com/cve/CVE-2026-90685 https://vuldb.com/submit/914027 https://vuldb.com/vuln/403218 https://vuldb.com/vuln/403218/cti

Dernières Vulnérabilités

CVE-2026-90687

A vulnerability was determined in GPAC up to f1219cde. This vulnerability affects the function gf_node_changed_internal of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation causes use after free. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is able to resolve this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. Upgrading the affected component is recommended.

VOIR DÉTAILS

CVE-2026-90686

A vulnerability was found in GPAC up to f1219cde. This affects the function gf_bt_report of the file scene_manager/loader_bt.c of the component MP4Box. The manipulation results in memory corruption. The attack may be performed from remote. The exploit has been made public and could be used. Upgrading to version abi-16.23 is able to mitigate this issue. The patch is identified as afca1f1181668d85941d51ed1adf647807d5d975. It is suggested to upgrade the affected component.

VOIR DÉTAILS

CVE-2026-16726

Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows.

VOIR DÉTAILS