CVE-2026-90573: GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference

Published Sep 13, 2026
·
Updated

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gfsgmfurldel of the file scenegraph/vrmltools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Upgrading to version abi-16.23 is sufficient to resolve this issue. The identifier of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is recommended to upgrade the affected component.

Affected Software

1 affected component
Gpac MP4Box<=f1219cde, <=abi-16.23

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade MP4Box to a version that resolves this vulnerability.

    Fixed in abi-16.23Patch 49dee5cad329cfed310c1682703df7daa47df31a
  2. Compensating control

    Restrict local access to MP4Box so only trusted users/hosts can execute the attack path (local access is required per advisory).

Event History

Sep 13, 2026
CVE Published
via MITRE·05:30 PM
Data Sourced
via MITRE·05:30 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Who is realistically exposed to this issue?

Systems running the GPAC MP4Box component with vulnerable code are exposed only to attackers who already have local access. The vulnerability affects the gf_sg_mfurl_del function in scenegraph/vrml_tools.c.

2

What level of access does an attacker need, and what is the likely impact?

An attacker needs local access and low privileges; no user interaction is required. Successful exploitation causes a null pointer dereference with availability impact, while no confidentiality or integrity impact is listed.

3

Is exploit code available?

Yes. The exploit is publicly available, increasing the practical risk for environments where untrusted or low-privileged local users can access the affected component.

4

What remediation is available?

Upgrade the affected component to version abi-16.23 or later. The identified patch is 49dee5cad329cfed310c1682703df7daa47df31a.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203