UBUNTU-CVE-2026-128239: Null Pointer Dereference
GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that use GPAC tools such as MP4Box to process attacker-controlled XMT scene content are exposed. A relevant example is chapter import, where a crafted scene can trigger the crash.
What does an attacker need to exploit it?
The attacker needs to provide a crafted XMT scene containing Form constraints that reference a group that does not exist. Exploitation requires a user or workflow to process that content, consistent with the user-interaction requirement.
Is this a confidentiality or integrity issue?
The reported impact is denial of service: the affected GPAC process can crash. The supplied severity vector indicates no confidentiality or integrity impact.