Description

A security vulnerability has been detected in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Upgrading to version abi-16.23 is able to address this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-13T19:16:52.997Z",
  "pubdate": "2026-09-13T19:16:52.997Z",
  "executiveSummary": "A null pointer dereference vulnerability exists within the GPAC multimedia framework, specifically impacting the MP4Box component.\nThe vulnerability resides in the gf_node_list_add_child function located in scenegraph/base_scenegraph.c.\nThis flaw allows a local attacker to trigger a crash, leading to a denial-of-service (DoS) condition.\nThe impact of this vulnerability is limited to service availability, as it involves the dereferencing of a null pointer, which typically results in abnormal program termination.\nThe attack vector is restricted to local execution, necessitating that an attacker have access to the target environment to process a maliciously crafted file.\nThe issue affects all GPAC versions up to f1219cde. No remote exploitation is possible according to current disclosures.\nThe vulnerability is addressed by upgrading to version abi-16.23 and applying the designated patch.\nOrganizations relying on MP4Box for scene graph processing should prioritize patching to maintain system stability and prevent potential exploitation via local file processing.",
  "technicalDetails": "The vulnerability is categorized as a null pointer dereference occurring within the scenegraph/base_scenegraph.c file of the MP4Box component in GPAC.\nThe root cause is an insecure handling of a pointer within the gf_node_list_add_child function. Under specific conditions, the function fails to validate the state or existence of a node object before performing operations that require a valid memory address.\nWhen the input provided to the scene graph parser is crafted to trigger a failure in node allocation or traversal, the logic inside gf_node_list_add_child attempts to access members of an uninitialized or null-valued pointer.\nThe attack flow requires the attacker to supply a specially crafted input file to MP4Box. As the application attempts to build the scene graph, it calls gf_node_list_add_child to append a child to a parent node. If the logic flow dictates that an expected pointer is null, the application executes a dereference instruction on the base address 0x0.\nThis behavior forces the Operating System to send a segmentation fault signal (SIGSEGV) to the process, leading to immediate termination. Because the defect occurs during the parsing of structural scene graph data, it effectively creates a Denial of Service (DoS) for the application.\nThe vulnerability is restricted to the local environment because it requires the attacker to invoke the MP4Box binary locally on the target system with the malicious file as an argument. There is no network interface involved in this specific attack path.\nThere are no specific authentication or privilege requirements beyond the capability to execute the binary locally. If MP4Box is utilized by an automated backend service or a web-based multimedia processing pipeline that accepts user-supplied files, this local attack can be scaled to impact services indirectly.\nThe vulnerability has been addressed in the codebase via patch 49dee5cad329cfed310c1682703df7daa47df31a, which introduces necessary sanity checks to ensure that pointers are verified as non-null before access. Users must migrate to version abi-16.23 to ensure the integrity of the scene graph manipulation routines.\nThe post-exploitation impact is primarily the disruption of the multimedia processing workflow; however, in complex memory environments, null pointer dereferences occasionally present opportunities for further exploitation if the execution environment allows for mapping at the zero page, though this is rare in modern hardened operating systems."
}