CVE-2026-90792 json
GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
published 2026-09-14 55 d ago modified 2026-09-14 55 d ago also EUVD-2026-77613
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the component MP4Box. This manipulation of the argument Target causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version abi-16.23 is capable of addressing this issue. Patch name: afca1f1181668d85941d51ed1adf647807d5d975. It is recommended to upgrade the affected component.
Patch / fix
- n/a GPAC abi-16.23
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 55 d ago
Exploit prediction
0.69% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/Ech06/CVE_submit/blob/main/gpac_3802.md referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- n/a GPAC
Classification
References
-
github.com
/gpac/gpac/commit/afca1f1181668d85941d51ed1adf647807d5d975
patch
-
github.com
/gpac/gpac/releases/tag/abi-16.23
patch
-
github.com
/Ech06/CVE_submit/blob/main/gpac_3802.md
exploit
-
vuldb.com
/vuln/403298
vdb-entry, technical-description
-
vuldb.com
/vuln/403298/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-90792
third-party-advisory
-
vuldb.com
/submit/914123
third-party-advisory
-
github.com
/gpac/gpac/issues/3802
issue-tracking
-
github.com
/gpac/gpac/
product
Sources
- CVE List CVE-2026-90792
- NVD CVE-2026-90792
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.