Description

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_sg_mfurl_del of the file scenegraph/vrml_tools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. Upgrading to version abi-16.23 is sufficient to resolve this issue. The identifier of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-13T18:16:49.780Z",
  "pubdate": "2026-09-13T18:16:49.780Z",
  "executiveSummary": "A null pointer dereference vulnerability has been identified in the MP4Box component of the GPAC multimedia framework, specifically within the gf_sg_mfurl_del function located in scenegraph/vrml_tools.c.\nThe vulnerability occurs due to improper handling of object references during the deletion process within the scene graph management logic. An attacker capable of providing a specially crafted input file can trigger a condition where the application attempts to access a null memory address.\nThe primary impact of this flaw is a crash of the MP4Box process, leading to a Denial of Service (DoS) condition. While the exploit is publicly available, exploitation requires local access to the system. Given that GPAC follows a rolling release strategy, users are urged to transition to a patched version to ensure stability and security.\nBecause the vulnerability allows for application-level disruption, it poses a risk to automated processing pipelines or services that rely on MP4Box for media container manipulation and scene graph parsing.",
  "technicalDetails": "The vulnerability is situated within the scenegraph/vrml_tools.c file, specifically in the gf_sg_mfurl_del function, which is responsible for the deallocation or removal of 'mfurl' (Multi-Function URL) structures within the GPAC scene graph architecture.\nThe root cause of this vulnerability is a lack of sufficient input validation or object state verification before a pointer dereference operation. Specifically, the function fails to verify whether the pointer passed to it points to a valid memory location before executing the deletion logic. When the component encounters a scenario where an expected structure is missing or null—potentially due to malformed VRML input data—the execution flow proceeds to dereference this null pointer.\nThe attack flow initiates when a user provides a maliciously crafted media or scene graph file to the MP4Box utility. Upon parsing, the internal state of the scene graph becomes inconsistent. When the engine reaches the gf_sg_mfurl_del function during the cleanup or processing phase, the software performs an illegal memory access by attempting to read from or write to the memory address zero.\nThis invalid access causes a segmentation fault, forcing the termination of the application process. Because the crash occurs during the execution of a core library function, it can be triggered repeatedly if the utility is used in a server-side environment to process user-supplied files. The vulnerability requires local access to the filesystem or the ability to pass a file to the utility, limiting the attack surface primarily to environments where untrusted files are processed locally by the MP4Box binary.\nThe vulnerability affects all versions of GPAC up to commit f1219cde. The logic flaw is specifically contained in the scene graph management modules that handle VRML-based metadata. Successful exploitation results in an immediate service disruption. There is no evidence currently suggesting that this vulnerability facilitates arbitrary code execution; however, the impact is reliably exploitable for system instability given the availability of public proof-of-concept exploits.\nMitigation requires upgrading the codebase to address the null pointer condition. The patch 49dee5cad329cfed310c1682703df7daa47df31a introduces necessary safety checks within the memory management routine to ensure that pointers are validated as non-null before the deletion operation is performed, effectively neutralizing the trigger condition for the crash."
}