{"id":"CVE-2026-128239","summary":"GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers","details":"GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service.","modified":"2026-11-15T02:46:35.950565302Z","published":"2026-11-13T09:33:47.579Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128239.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-476"]},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/11/13/3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128239.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128239"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gpac-through-26.07.0-null-pointer-dereference-via-mpeg-4-form-handlers"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/4029"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/bc416b997622e43de65afab3bae9b7d05d72f2b0"},{"type":"PACKAGE","url":"https://github.com/gpac/gpac"},{"type":"ARTICLE","url":"https://github.com/gpac/gpac/blob/v26.07.0/src/compositor/mpeg4_form.c#L620-L621"},{"type":"EVIDENCE","url":"https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/221/221_ab_apply_compositor_mpeg4_form_c_627.xmt"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"bc416b997622e43de65afab3bae9b7d05d72f2b0"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"26.07.0"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"bc416b997622e43de65afab3bae9b7d05d72f2b0"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["abi-16.30","abi-16.29","abi-16.28","abi-16.27","abi-16.26","abi-16.25","abi-16.24","abi-16.23","abi-16.22","v26.07.0","abi-16.21","abi-16.20","abi-16.19","abi-16.18","abi-16.17","abi-16.16","abi-16.15","abi-16.14","abi-16.13","abi-16.11","abi-16.10","abi-16.9","abi-16.8","abi-16.7","abi-16.6","v26.02.0","abi-16.5","abi-16.4","abi-16.3","abi-16.2","abi-16","abi-15.2","abi-15.1","abi-15.0","abi-15","abi-14.0","abi-14","abi-13.0","abi-13","abi-12.27","abi-12.26","abi-12.25","abi-12.24","abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128239.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}