CVE-2026-90792
GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 14, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 13, 2026
Description
A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 5.0 Medium | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
GPACn/a |
|
References
- VDB-403298 | GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereferencevdb-entrytechnical-description
- VDB-403298 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-90792 | CVE Analysis and Reportthird-party-advisory
- Submit #914123 | GPAC GPAC (MP4Box) gpac f1219cde (master, 2026-07-25) NULL Pointer Dereferencethird-party-advisory
- https://github.com/gpac/gpac/issues/3802issue-tracking
- https://github.com/Ech06/CVE_submit/blob/main/gpac_3802.mdexploit
- https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975patch
- https://github.com/gpac/gpac/releases/tag/abi-16.23patch
- https://github.com/gpac/gpac/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.