CVE-2026-128239
Deferred Deferred - Pending Action

NULL Pointer Dereference in GPAC MP4Box via Malformed XMT Scene

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128239
EUVD
EUVD-2026-125053

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gpac gpac From 0 (inc) to 26.7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GPAC through version 26.07.0 has a NULL pointer dereference flaw in the MPEG-4 Form spatial-constraint handlers. This occurs in src/compositor/mpeg4_form.c where group lookups are not properly checked. Attackers can exploit this by providing a crafted XMT scene that references a non-existent group in Form constraints, causing tools like MP4Box to crash during chapter import, leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires checking for crashes in GPAC tools like MP4Box when processing XMT scenes with Form constraints referencing non-existent groups. Monitor for segmentation faults or denial-of-service events during chapter import operations.

Impact Analysis

This vulnerability can crash applications like MP4Box when processing malicious XMT scenes, causing denial of service. If you use GPAC for media processing, an attacker could exploit this to disrupt your workflow or crash the software.

Mitigation Strategies

Update GPAC to the latest version (26.07.0 or later) to patch the NULL pointer dereference issue. Avoid processing untrusted XMT scenes with Form constraints until patched. Implement input validation for XMT files to prevent crafted scenes from triggering crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128239. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...