CVE-2026-88339: Null Pointer Dereference
A NULL pointer dereference vulnerability exists in the gfsgvrmlfieldclone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to supply a specially crafted input file that causes GPAC to clone a PROTO default SFImage field with a NULL source pointer. Successful exploitation causes an application crash and denial of service.
Who is exposed to this vulnerability?
GPAC instances that process untrusted input files are exposed, particularly where an attacker can cause a crafted file to be opened or otherwise parsed. The affected code is identified as gf_sg_vrml_field_clone() in GPAC 2d7da22e (26.08-DEV).
How can I determine whether a crash may be related to this issue?
Investigate crashes occurring while processing input files that contain PROTO default SFImage fields. A relevant failure condition is a NULL pointer dereference in gf_sg_vrml_field_clone().