CVE-2026-90573
Received Received - Intake

Null Pointer Dereference in GPAC MP4Box

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Upgrading to version abi-16.23 is sufficient to resolve this issue. The identifier of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-13
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90573
EUVD
EUVD-2026-77054

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90573 is a null pointer dereference vulnerability in GPAC's MP4Box tool. It occurs in the gf_sg_mfurl_del function when processing a crafted MP4 file with an improperly initialized MPEG-4 BIFS scene graph. Using the -nstatx option triggers a crash by attempting to dereference a NULL SFURL pointer during teardown.

Detection Guidance

To detect this vulnerability, monitor for crashes in MP4Box when processing MP4 files with the `-nstatx` option. Use the provided proof-of-concept file `poc_21_nstatx.zip` to test if the system is vulnerable. Check for segmentation faults or null pointer dereference errors in logs when running MP4Box on crafted files.

Impact Analysis

This vulnerability can cause MP4Box to crash, leading to a denial of service when processing malicious MP4 files. Since local access is required, attackers need to trick users into opening a specially crafted file. The exploit is publicly available, increasing the risk of misuse.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch commit 49dee5cad329cfed310c1682703df7daa47df31a. Avoid processing untrusted MP4 files with MP4Box, especially using the `-nstatx` option. Implement input validation for MP4 files to prevent crafted content from triggering the flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90573. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart