Executive brief
GPAC is a multimedia framework used to process and playback media files. A NULL pointer dereference vulnerability in the VRML field cloning function can be triggered by a specially crafted input file, causing the application to crash and become unavailable. This results in a denial of service condition affecting any system using GPAC to process untrusted media files.
Technical details
A NULL pointer dereference (CWE-476) exists in gf_sg_vrml_field_clone() when cloning a PROTO default SFImage field with a NULL source pointer. The vulnerability occurs during VRML scene graph field duplication when processing malformed input. An attacker can craft an input file to trigger the crash via the affected cloning function, causing denial of service with no authentication or user interaction required beyond file processing.
Affected products
- GPAC Project GPAC 2d7da22e (26.08-DEV)
Timeline
- 2026-09-22: disclosed