Executive brief
GPAC is a multimedia framework used for video streaming, transcoding, and packaging. MP4Box, a component within GPAC, is vulnerable to a null pointer dereference when processing malformed BIFS scene files. An attacker can craft a malicious scene file to crash MP4Box during import, causing a denial of service to any service or application that processes untrusted media files.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the gf_node_list_get_child() function within scenegraph/base_scenegraph.c. The root cause lies in gf_bt_parse_bifs_command() in scene_manager/loader_bt.c, which treats a target field as a child-node list without validating that the field is actually the "children" field. This causes an invalid pointer to be dereferenced, leading to a segmentation fault near address 0x8. The attack is remotely exploitable via a crafted BT/BIFS scene file supplied to MP4Box (typically via the -add command-line option). The fix, commit afca1f1181668d85941d51ed1adf647807d5d975, validates the target field name before dereferencing it and rejects invalid commands. Upgrading to version abi-16.23 or later resolves the issue.
Affected products
- GPAC GPAC up to f1219cde; fixed in abi-16.23
Timeline
- 2026-09-14: disclosed: CVE-2026-90792 published
- 2026-09-14: patched: Fix available in commit afca1f1181668d85941d51ed1adf647807d5d975; upgrade to version abi-16.23