CVE-2026-90792
Deferred Deferred - Pending Action

Null Pointer Dereference in GPAC MP4Box

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulDB

Description
A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90792
EUVD
EUVD-2026-77613

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
gpac mp4box to f1219cde (inc)
gpac gpac abi-16.23
gpac gpac f1219cde

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90792 is a NULL pointer dereference vulnerability in GPAC's MP4Box component. It occurs in the function gf_node_list_get_child when parsing a malformed indexed BIFS command. The issue arises because gf_bt_parse_bifs_command incorrectly treats a target field as a child-node list without validation, passing an invalid pointer to gf_node_list_get_child. This leads to a segmentation fault when the function attempts to read memory near address 0x8.

Detection Guidance

To detect this vulnerability, monitor for crashes in GPAC's MP4Box when processing BT/BIFS scene files. Check for segmentation faults in scenegraph/base_scenegraph.c, particularly in gf_node_list_get_child. Use debug logs or attach a debugger to observe null pointer dereferences during file parsing.

Impact Analysis

This vulnerability can cause MP4Box to crash during import of a crafted BT/BIFS scene file, resulting in a denial of service. Any application exposing GPAC's BIFS scene parsing to untrusted input is potentially affected. The exploit can be carried out remotely by sending malformed input.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in GPAC's MP4Box component causing a null pointer dereference. However, if exploited, it could lead to denial-of-service conditions in systems processing untrusted media files, potentially disrupting services that handle sensitive data. Compliance impact would depend on system-specific use cases rather than the vulnerability itself.

Mitigation Strategies

Upgrade GPAC to version abi-16.23 or apply the patch commit afca1f1181668d85941d51ed1adf647807d5d975. Avoid processing untrusted BT/BIFS scene files with MP4Box. Restrict access to GPAC components handling BIFS parsing to reduce exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90792. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart