CVE-2026-90576
Received Received - Intake

Null Pointer Dereference in GPAC MP4Box

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 is able to address this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-14
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90576
EUVD
EUVD-2026-77061

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac mp4box abi-16.23
gpac mp4box to f1219cde (exc)
gpac gpac to f1219cde (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90576 is a null pointer dereference vulnerability in GPAC's MP4Box tool. It occurs in the function gf_node_list_add_child within the file scenegraph/base_scenegraph.c. When processing a crafted MP4 file using the -nstatx command, an invalid pointer dereference leads to a segmentation fault. The attack requires local access and can be triggered by a specially designed MP4 file.

Detection Guidance

To detect this vulnerability, monitor for segmentation faults (SEGV) when processing MP4 files with MP4Box using the -nstatx command. Use AddressSanitizer to identify invalid pointer dereferences in gf_node_list_add_child. Check for crashes when handling crafted input files like poc_23_nstatx.

Impact Analysis

This vulnerability can cause MP4Box to crash when processing malicious MP4 files, leading to a denial-of-service condition. Since the attack requires local access, it primarily affects users who process untrusted MP4 files on their systems. The impact is limited to program termination and potential disruption of media processing tasks.

Compliance Impact

This vulnerability is a local denial-of-service issue caused by a segmentation fault in GPAC MP4Box when processing crafted MP4 files. It does not directly involve data exposure or unauthorized access, so it likely has minimal direct impact on GDPR or HIPAA compliance. However, repeated crashes could disrupt systems processing sensitive data, potentially affecting availability requirements under these regulations.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch 49dee5cad329cfed310c1682703df7daa47df31a. Avoid processing untrusted MP4 files with MP4Box -nstatx. Restrict local access to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90576. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart