https://seclists.org/oss-sec/2026/q4/689: CVE-2026-128239: GPAC/MP4Box: NULL Pointer Dereference in MPEG-4 Form Handlers via Crafted XMT Input
Published Nov 13, 2026
·Updated
Affected Software
1 affected component
Gpac GPAC (MP4Box)<=26.07.0
MP4Box users who import attacker-controlled XMT scene input, including during chapter import, are exposed. The CVSS vector indicates local access and user interaction are required.
The attacker needs a crafted XMT scene containing a Form node whose layout constraints reference an uninitialised or missing group. Several spatial-constraint handlers are affected, including AB, AR, SH, AL, and AT.
Do not import XMT input from untrusted sources. Restrict chapter-import workflows to XMT scenes that have been reviewed or produced by trusted sources.
The published CVE record lists GPAC versions through 26.07.0 as affected, and the issue was reproduced on 26.08-DEV-rev263-g3f056542b-master at commit 3f056542b377cc73677d19490bfe1b46c52c9be7. The corrective change is commit bc416b997622e43de65afab3bae9b7d05d72f2b0; vulnerable processing can terminate MP4Box with SIGSEGV.