Vulnerability · Published Sep 14, 2026 · Assigned by VulDB

CVE-2026-90792GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference

Medium 4.3

In plain English

A medium-severity null pointer dereference in GPAC. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.7%top 47.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.

Affected products (as reported)

Vendor	Product	Versions
n/a	GPAC	f1219cde

Weakness: CWE-476, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

References

VDB-403298 | GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference vdb-entry, technical-description
VDB-403298 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-90792 | CVE Analysis and Report third-party-advisory
Submit #914123 | GPAC GPAC (MP4Box) gpac f1219cde (master, 2026-07-25) NULL Pointer Dereference third-party-advisory
https://github.com/gpac/gpac/issues/3802 issue-tracking
https://github.com/Ech06/CVE_submit/blob/main/gpac_3802.md exploit
https://github.com/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975 patch
https://github.com/gpac/gpac/releases/tag/abi-16.23 patch
https://github.com/gpac/gpac/ product