Description

A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-14T16:17:40.907Z",
  "pubdate": "2026-09-14T16:17:40.907Z",
  "executiveSummary": "A Null Pointer Dereference vulnerability exists in the GPAC MP4Box component, specifically within the gf_node_list_get_child function.\nThe flaw stems from improper handling of the Target argument, leading to a crash or potential undefined behavior when triggered.\nThis vulnerability is remotely exploitable, allowing an unauthenticated attacker to induce a denial-of-service (DoS) state by processing malicious media content.\nThe issue affects GPAC versions up to f1219cde and carries significant risk due to the existence of publicly available exploit code.\nImmediate remediation requires upgrading to version abi-16.23 to ensure the application logic correctly validates pointers before access.",
  "technicalDetails": "The vulnerability is located in scenegraph/base_scenegraph.c within the GPAC library, specifically targeting the gf_node_list_get_child function.\nRoot Cause: The function fails to perform adequate validation on the 'Target' argument passed to it during scenegraph operations. When the function receives a null pointer or an unexpected state for this argument, it attempts to access memory addresses associated with this pointer, resulting in a null pointer dereference.\nAttack Flow: An attacker can craft a malicious media file that forces the MP4Box component to traverse an improperly initialized or structured scenegraph. Upon reaching the vulnerable code path in gf_node_list_get_child, the application executes the dereference of the null Target pointer.\nExploitation Method: Because the exploit is publicly available, an attacker can deliver a specially crafted file to a system or service utilizing the MP4Box component. When the component attempts to parse or process this file, the application process will terminate abruptly, resulting in a crash and denial-of-service. Given the nature of media processing workflows, this can be triggered remotely via file upload services or automated media transcoding pipelines.\nAffected Versions: All GPAC builds up to commit f1219cde are susceptible to this flaw.\nImpact: Successful exploitation results in the immediate crash of the application process. While primarily a denial-of-service vulnerability, such crashes in media processing libraries can sometimes lead to memory corruption issues if the dereference can be manipulated in specific memory layouts, although the primary documented impact is system instability and service disruption.\nExecution Context: The vulnerability does not explicitly require specific user privileges or authentication, as it is triggered during the standard parsing process of the media container. The impact is limited to the process space of the application utilizing the GPAC library."
}