Quick answers
- Is CVE-2026-90792 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90792 being exploited in the wild.
- How severe is CVE-2026-90792?
- Medium severity, with a CVSS score of 4.3, published 14 September 2026.
- Which products and versions are affected?
- Gpac up to f1219cde; fixed in abi-16.23.
- Is there a fix for CVE-2026-90792?
- A patch was published on 2026-09-14: Fix available in commit afca1f1181668d85941d51ed1adf647807d5d975; upgrade to version abi-16.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-90792 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-90792?
- Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the gf_node_list_get_child() function within scenegraph/base_scenegraph.c. The root cause lies in gf_bt_parse_bifs_command() in scene_manager/loader_bt.c, which treats a target field as a child-node list without validating that the field is actually the "children" field. This causes an invalid pointer to be dereferenced, leading to a segmentation fault near address 0x8. The attack is remotely exploitable via a crafted BT/BIFS scene file supplied to MP4Box (typically via the -add command-line option). The fix, commit afca1f1181668d85941d51ed1adf647807d5d975, validates the target field name before dereferencing it and rejects invalid commands. Upgrading to version abi-16.23 or later resolves the issue.
Affected products
- GPAC GPAC up to f1219cde; fixed in abi-16.23
Timeline
- 2026-09-14: disclosed: CVE-2026-90792 published
- 2026-09-14: patched: Fix available in commit afca1f1181668d85941d51ed1adf647807d5d975; upgrade to version abi-16.23