Heap-Based Buffer Overflow in GPAC's URL Handler Function

CVE-2026-91088

What is CVE-2026-91088?

A vulnerability exists in the GPAC media framework affecting the URL Handler component. Specifically, the gf_url_concatenate_ex function contains a flaw that can lead to a heap-based buffer overflow. This vulnerability requires local access to exploit effectively, which could allow attackers to manipulate memory, potentially resulting in code execution or denial of service. Users are advised to upgrade to version abi-16.23 or later, which includes a patch to mitigate this vulnerability. The fix is documented with the identifier afca1f1181668d85941d51ed1adf647807d5d975.

References