A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference.
The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue.
Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
n/a:gpac
References 9
https://vuldb.com/vuln/403298
VDB-403298 | GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
https://vuldb.com/vuln/403298/cti
VDB-403298 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/cve/CVE-2026-90792
CVE-2026-90792 | CVE Analysis and Report
https://vuldb.com/submit/914123
Submit #914123 | GPAC GPAC (MP4Box) gpac f1219cde (master, 2026-07-25) NULL Pointer Dereference
https://github.com/gpac/gpac/issues/3802
NVD
https://github.com/Ech06/CVE_submit/blob/main/gpac_3802.md
NVD
https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975
NVD
https://github.com/gpac/gpac/releases/tag/abi-16.23
NVD
https://github.com/gpac/gpac/
NVD