CVE-2026-90609
Received Received - Intake

Null Pointer Dereference in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90609
EUVD
EUVD-2026-77146

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (exc)
gpac mp4box abi-16.23
gpac gpac abi-16.23

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90609 is a null pointer dereference vulnerability in GPAC's MP4Box tool. It occurs when processing a maliciously crafted MP4 file with the -nstatx option, causing a crash due to a NULL pointer access in the scenegraph/base_scenegraph.c file. The issue arises during recursive scene graph traversal when node pointers are not validated before access.

Detection Guidance

To detect this vulnerability, check if GPAC MP4Box is installed and running version f1219cde or earlier. Run MP4Box with the -nstatx option on a test MP4 file to see if it triggers a segmentation fault or crash. Monitor system logs for null pointer dereference errors during MP4Box operations.

Impact Analysis

This vulnerability can cause MP4Box to crash when processing a specially crafted file, leading to a denial of service. Since the attack requires local access, it primarily affects users who process untrusted MP4 files on their systems. The impact is limited to application crashes and potential service disruption.

Mitigation Strategies

Upgrade GPAC MP4Box to version abi-16.23 or later. Apply the patch 49dee5cad329cfed310c1682703df7daa47df31a. Avoid processing untrusted MP4 files with the -nstatx option until patched. Validate node pointers in scene graph traversal functions to prevent null pointer dereferences.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart