CVE-2026-90609

GPAC MP4Box vrml_tools.c null pointer dereference

View on CVE.org
Published Sep 14, 2026 CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

Analysis

AI-generated

Technical impact

The vulnerability in GPAC’s MP4Box component, specifically in the vrml_tools.c file, triggers a null pointer dereference due to an unknown function. This flaw is characterized by CWE-476 and CWE-404 weaknesses. The resulting crash or instability occurs when the application processes malformed or crafted data. The CVSS score of 4.8 reflects a medium severity, and because the exploit path requires local interaction, the risk is limited to local users.

Affected Systems

GPAC versions up to the commit f1219cde are affected. The issue is resolved in release abi‑16.23, which incorporates the patch identified by commit 49dee5cad329cfed310c1682703df7daa47df31a. No other vendors or product versions are listed as impacted.

Risk and Exploitability

The risk is confined to local users who can execute MP4Box, as the attack vector is local. With an EPSS score of less than 1% and no listing in CISA’s KEV catalog, the likelihood of exploitation is very low but still non‑negligible. Public disclosure and the available exploit mean that updating promptly mitigates the threat.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade GPAC to version abi‑16.23 or newer to incorporate the null pointer dereference fix.
  • If using a custom build that does not include the release update, apply patch commit 49dee5cad329cfed310c1682703df7daa47df31a.
  • Restrict local execution of MP4Box by enforcing least‑privilege or container isolation to prevent untrusted parties from triggering the vulnerability.

Generated by OpenCVE AI on September 15, 2026 at 16:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.
Title GPAC MP4Box vrml_tools.c null pointer dereference
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-404
CWE-476
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release

  • CWE-476

    NULL Pointer Dereference

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 14, 2026, 3:04 PM
Reserved
Sep 12, 2026, 7:39 PM

View source JSON

Updated
Sep 14, 2026, 3:04 PM

JSON

Status
Deferred
Published
Sep 14, 2026, 1:16 AM
Modified
Sep 14, 2026, 8:56 PM

View source JSON

No data.

Updated
Sep 15, 2026, 4:15 PM

JSON