CVE-2026-90576: GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference
A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gfnodelistaddchild of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 is able to address this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Boxto a version that resolves this vulnerability.Fixed in abi-16.23Patch 49dee5cad329cfed310c1682703df7daa47df31a
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires local access and low privileges. No user interaction is required.
What is the likely impact of successful exploitation?
The vulnerability causes a null pointer dereference in MP4Box, resulting in an availability impact. The supplied severity vector indicates no confidentiality or integrity impact.
Which versions should be remediated?
GPAC installations up to commit f1219cde are affected. Upgrade the affected MP4Box component to version abi-16.23, which includes patch 49dee5cad329cfed310c1682703df7daa47df31a.
Is exploitation theoretical?
No. An exploit has been publicly disclosed and may be used.