CVE-2026-90610
A vulnerability was found in GPAC up to f1219cde. This affects the function gf_svg_attributes_copy of the file scenegraph/svg_attributes.c of the component MP4Box. Performing a manipulation results in buffer over-read. The attack is only possible with local access. The exploit has been made public and could be used. Upgrading to version abi-16.23 mitigates this issue. The patch is named afca1f1181668d85941d51ed1adf647807d5d975. Upgrading the affected component is recommended.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.8
- CVSS vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- EPSS probability
- 0.12%
- CWE
- CWE-126, CWE-119
- Published
- 2026-09-14
- Last modified
- 2026-09-15
Affected products
- n/a GPAC
- n/a GPAC
Weakness type
Related vulnerabilities
- CVE-2017-17772 — Multiple buffer overread vulnerabilities in WLAN
- CVE-2025-60003 — Junos OS and Junos OS Evolved: BGP update with a set of specific attributes causes rpd crash
- CVE-2024-33056 — Buffer Over-read in MProc
- CVE-2024-33047 — Buffer Over-read in Display
- CVE-2018-5852 — Buffer Over-read in IPA
- CVE-2024-45552 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2025-21488 — Buffer Over-read in Data Network Stack & Connectivity
- CVE-2025-21487 — Buffer Over-read in Data Network Stack & Connectivity