Description

A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-14T01:16:28.360Z",
  "pubdate": "2026-09-14T01:16:28.360Z",
  "executiveSummary": "A null pointer dereference vulnerability exists in the GPAC MP4Box component, specifically within the scenegraph/vrml_tools.c file. The flaw resides in an unidentified function responsible for processing VRML scene data.\nThe vulnerability allows an attacker with local access to trigger a crash, leading to a denial-of-service (DoS) condition. As the exploit is publicly disclosed, the risk of exploitation is elevated for systems that process untrusted VRML files locally.\nThe issue affects all GPAC versions up to f1219cde. Successful exploitation requires the user to execute the vulnerable MP4Box component with a maliciously crafted file, causing the application to dereference a null pointer during the scenegraph parsing stage.\nThis vulnerability does not require network access, as the attack surface is limited to the local file processing capabilities of MP4Box. Organizations using GPAC should prioritize upgrading to version abi-16.23 to implement the necessary fix provided in patch 49dee5cad329cfed310c1682703df7daa47df31a.",
  "technicalDetails": "The vulnerability is a classic null pointer dereference occurring within the scenegraph/vrml_tools.c source file of the MP4Box component in GPAC. This component is primarily responsible for the multiplexing and processing of multimedia streams, including the parsing of VRML (Virtual Reality Modeling Language) scene graphs.\nThe root cause of this vulnerability lies in an internal function that fails to validate the return value or the state of a pointer before attempting to access or manipulate the memory address it references. In the context of VRML parsing, when the parser encounters a specifically structured input that triggers an unexpected state—likely due to missing node definitions, corrupted file headers, or malformed scene objects—the affected function fails to assign a valid memory address to a pointer variable. Instead, the pointer remains null.\nWhen the program execution flow proceeds to dereference this null pointer, the operating system's memory management unit generates an exception, typically resulting in an immediate segmentation fault (SIGSEGV) and the termination of the MP4Box process.\nThe attack flow proceeds as follows: An attacker creates a malformed VRML input file designed to traverse the specific code path in scenegraph/vrml_tools.c that leads to the null assignment. The attacker then invokes the MP4Box binary locally, passing the malicious file as an argument. As MP4Box attempts to parse the scene structure, it encounters the logic error, fails to verify the pointer's validity, and dereferences the null address. This behavior results in a process crash, thereby achieving a localized denial-of-service.\nBecause the vulnerability is triggered during the file processing phase, it does not require network connectivity or authentication. The attack surface is strictly local, depending on the attacker's ability to supply or influence the input file processed by a user or an automated system. Since the exploit is publicly disclosed, the technical hurdle for reproduction is low. The patch, 49dee5cad329cfed310c1682703df7daa47df31a, resolves this by adding explicit null pointer checks (guard clauses) before the critical memory access, ensuring that the application handles such anomalous inputs gracefully rather than crashing."
}