CVE-2026-90792: GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
A flaw has been found in GPAC up to f1219cde. This issue affects the function gfnodelistgetchild of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Boxto a version that resolves this vulnerability.Fixed in abi-16.23Patch afca1f1181668d85941d51ed1adf647807d5d975
Event History
Frequently Asked Questions
What is required for exploitation?
An attacker can exploit the issue remotely by manipulating the Target argument processed by MP4Box. No privileges are required, but user interaction is required according to the supplied vector.
What is the practical impact?
The null pointer dereference can cause a denial of service. The supplied impact ratings indicate no confidentiality or integrity impact.
Which versions should be remediated?
GPAC is affected up to revision f1219cde. Upgrade the affected component to version abi-16.23; the identified patch is afca1f1181668d85941d51ed1adf647807d5d975.
Is exploitation theoretical?
No. An exploit has been published and may be used.