CVE-2026-92474 GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free
A local attacker can exploit a use-after-free flaw in GPAC's Proto Link Handler to potentially execute arbitrary code or cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92474?
CVE-2026-92474 is a medium-severity use after free vulnerability in GPAC, published on 16 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of the file src/compositor/mpeg4_inline.c of the component Proto Link Handler. The manipulation results in use after free. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. Upgrading to version abi-16.24 mitigates this issue. The patch is identified as e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is recommended.
Which versions are affected by CVE-2026-92474?
How do I fix CVE-2026-92474?
No fix has been published for CVE-2026-92474 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-92474 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92474 exists.
Sources
Also known as GHSA-m834-xpcj-5vc2, UBUNTU-CVE-2026-92474.