CVE-2026-90609: GPAC MP4Box vrml_tools.c null pointer dereference
A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrmltools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Boxto a version that resolves this vulnerability.Fixed in abi-16.23Patch 49dee5cad329cfed310c1682703df7daa47df31a
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Only local users are in scope, since exploitation requires a local environment and low privileges. The disclosed impact is limited to availability through a null pointer dereference; no confidentiality or integrity impact is listed.
Which versions need to be remediated?
GPAC MP4Box versions up to f1219cde are affected. Upgrading to version abi-16.23 resolves the issue; the referenced patch is 49dee5cad329cfed310c1682703df7daa47df31a.
How urgent is remediation?
The issue is rated low severity with a 3.3 score, but public exploit disclosure is noted. Prioritize the upgrade on systems where untrusted or lower-privileged local users can run or influence MP4Box.