Executive brief
GPAC is an open-source multimedia framework used for video processing, packaging, and delivery. A null pointer dereference vulnerability in the MP4Box component can cause the application to crash when processing malformed MP4 files, leading to denial of service and potential disruption of multimedia processing operations.
Technical details
A null pointer dereference vulnerability exists in the gf_node_list_add_child function within scenegraph/base_scenegraph.c of GPAC's MP4Box component. The vulnerability is triggered when processing specially crafted input that results in a null pointer being dereferenced. The attack vector is local only, requiring the attacker to supply a malicious file to the application. Successful exploitation results in application crash (denial of service). A patch is available in version abi-16.23 (commit 49dee5cad329cfed310c1682703df7daa47df31a).
Affected products
- GPAC GPAC up to f1219cde
Timeline
- 2026-09-13: disclosed
- 2026-07-28: patched: Patch commit 49dee5cad329cfed310c1682703df7daa47df31a, available in version abi-16.23