CVE-2026-128239: GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers
GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service.
Affected Software
Event History
Frequently Asked Questions
What attacker access is required to trigger the crash?
An attacker needs to supply a crafted XMT scene that contains Form constraints referencing a non-existent group. Exploitation requires a user or process to import or otherwise process that crafted scene, such as during MP4Box chapter import.
What is the practical impact of successful exploitation?
Successful exploitation crashes the affected GPAC process, resulting in denial of service. The provided data does not indicate confidentiality or integrity impact.
Which code path should be reviewed when assessing exposure?
Review workflows that process untrusted XMT scenes and use MPEG-4 Form spatial-constraint handlers, particularly MP4Box chapter-import operations. The vulnerable handling is in src/compositor/mpeg4_form.c and involves unchecked group lookups.