CVE-2026-90609 - Vulnerability Details

- GPAC MP4Box vrml_tools.c null pointer dereference

Description

A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

Published: 2026-09-14

Score: 4.8 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability in GPAC’s MP4Box component, specifically in the vrml_tools.c file, triggers a null pointer dereference due to an unknown function. This flaw is characterized by CWE-476 and CWE-404 weaknesses. The resulting crash or instability occurs when the application processes malformed or crafted data. The CVSS score of 4.8 reflects a medium severity, and because the exploit path requires local interaction, the risk is limited to local users.

Affected Systems

GPAC versions up to the commit f1219cde are affected. The issue is resolved in release abi‑16.23, which incorporates the patch identified by commit 49dee5cad329cfed310c1682703df7daa47df31a. No other vendors or product versions are listed as impacted.

Risk and Exploitability

The risk is confined to local users who can execute MP4Box, as the attack vector is local. With an EPSS score of less than 1% and no listing in CISA’s KEV catalog, the likelihood of exploitation is very low but still non‑negligible. Public disclosure and the available exploit mean that updating promptly mitigates the threat.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

GPAC

affected

Version	Status	Constraints
`f1219cde`	affected	—
`abi-16.23`	unaffected	—

No data.

Vendor Product Confidence Versions

Gpac

95%

Version	Status	Scheme	Platform
`f1219cde`	affected	code_commit	—
`abi-16.23`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade GPAC to version abi‑16.23 or newer to incorporate the null pointer dereference fix.
If using a custom build that does not include the release update, apply patch commit 49dee5cad329cfed310c1682703df7daa47df31a.
Restrict local execution of MP4Box by enforcing least‑privilege or container isolation to prevent untrusted parties from triggering the vulnerability.

Generated by OpenCVE AI on September 15, 2026 at 16:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00168.

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/gpac/gpac/
https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a
https://github.com/gpac/gpac/issues/3818
https://github.com/gpac/gpac/releases/tag/abi-16.23
https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-NULL-Pointer-Dereference-in-gf_node_set_cyclic_traverse_flag.md
https://vuldb.com/cve/CVE-2026-90609
https://vuldb.com/submit/913514
https://vuldb.com/vuln/403191
https://vuldb.com/vuln/403191/cti

History

Mon, 14 Sep 2026 21:00:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 14 Sep 2026 00:45:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
Title		GPAC MP4Box vrml_tools.c null pointer dereference
First Time appeared		Gpac Gpac gpac
Weaknesses		CWE-404 CWE-476
CPEs		cpe:2.3:a:gpac:gpac::::::::
Vendors & Products		Gpac Gpac gpac
References		https://github.com/gpac/gpac/ https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a https://github.com/gpac/gpac/issues/3818 https://github.com/gpac/gpac/releases/tag/abi-16.23 https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-NULL-Pointer-Dereference-in-gf_node_set_cyclic_traverse_flag.md https://vuldb.com/cve/CVE-2026-90609 https://vuldb.com/submit/913514 https://vuldb.com/vuln/403191 https://vuldb.com/vuln/403191/cti
Metrics		cvssV2_0 `{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}` cvssV3_0 `{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV3_1 `{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}` cvssV4_0 `{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}`

Subscriptions

Gpac Gpac

MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-09-14T00:30:08.823Z

Updated: 2026-09-14T15:04:05.973Z

Reserved: 2026-09-12T19:39:11.111Z

Link: CVE-2026-90609

Vulnrichment

Updated: 2026-09-14T15:04:00.477Z

NVD

Status : Deferred

Published: 2026-09-14T01:16:28.360

Modified: 2026-09-14T20:56:48.220

Link: CVE-2026-90609

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-15T16:15:15Z

Weaknesses

CWE-404
Improper Resource Shutdown or Release
CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Local

Access Complexity Low

Authentication Single

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

Exploitation poc

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object