{"id":"CVE-2026-90609","summary":"GPAC MP4Box vrml_tools.c null pointer dereference","details":"A vulnerability has been found in GPAC up to f1219cde. The impacted element is an unknown function of the file scenegraph/vrml_tools.c of the component MP4Box. Such manipulation leads to null pointer dereference. The attack can only be performed from a local environment. The exploit has been disclosed to the public and may be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component.","modified":"2026-09-16T08:09:42.065895Z","published":"2026-09-14T00:30:08.823Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-404","CWE-476"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90609.json","unresolved_ranges":[{"extracted_events":[{"introduced":"f1219cde"},{"last_affected":"f1219cde"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://github.com/gpac/gpac/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90609.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90609"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90609"},{"type":"ADVISORY","url":"https://vuldb.com/submit/913514"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403191"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/3818"},{"type":"REPORT","url":"https://vuldb.com/vuln/403191/cti"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a"},{"type":"FIX","url":"https://github.com/gpac/gpac/releases/tag/abi-16.23"},{"type":"EVIDENCE","url":"https://github.com/r1ck9-2q/cve_summit/blob/main/Vuln-GPAC-MP4Box-NULL-Pointer-Dereference-in-gf_node_set_cyclic_traverse_flag.md"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"49dee5cad329cfed310c1682703df7daa47df31a"},{"fixed":"2aa431eaf732c1a7e9a966ea12049fc001d91e04"}],"database_specific":{"source":"REFERENCES"}}],"versions":["abi-16.22","v26.07.0","abi-16.21","abi-16.20","abi-16.19","abi-16.18","abi-16.17","abi-16.16","abi-16.15","abi-16.14","abi-16.13","abi-16.11","abi-16.10","abi-16.9","abi-16.8","abi-16.7","abi-16.6","v26.02.0","abi-16.5","abi-16.4","abi-16.3","abi-16.2","abi-16","abi-15.2","abi-15.1","abi-15.0","abi-15","abi-14.0","abi-14","abi-13.0","abi-13","abi-12.27","abi-12.26","abi-12.25","abi-12.24","abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90609.json","vanir_signatures_modified":"2026-09-16T08:09:42Z","vanir_signatures":[{"source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/filters/reframe_av1.c"},"deprecated":false,"digest":{"line_hashes":["145568147277314144082398432589161068189","323211987463172907832753121077838423608","334072999313077448348278629071219093542","213978246609415984910756497938366017899"],"threshold":0.9},"id":"CVE-2026-90609-09f178fa","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["51108576564257053543762696819462400282","259294840328832389959544726322151380567","59916539506646210065194847055678448728","300238807050437853936955135568176966059","223769201974597684531500193741212411747","80660733125987452001085054117914048875","112169619435561680698232603363042782692"],"threshold":0.9},"id":"CVE-2026-90609-1f46133a","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/scenegraph/mpeg4_nodes.c"},"deprecated":false},{"source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/scenegraph/commands.c","function":"gf_sg_command_apply"},"deprecated":false,"digest":{"function_hash":"110679161136971273473639213289741930210","length":20812},"id":"CVE-2026-90609-4284c46a","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"include/gpac/nodes_mpeg4.h"},"deprecated":false,"digest":{"line_hashes":["147536943697249079035706747598503564734","180365077083521959581071390618345875318","149849326907462702416618439744907718963","286983107300281276276126212713909112572","148477810192675453311669414321021064024","190087602732512230006224780797679455998","336532700609265496841581701912467920779","326806907354868459117004192629848673584","227617894656014770987083667594120534066","24899471506566668329937456348500100634","264693999720362236485313853524336779919","302493109199944252982541211289961409443","46368018197146278258553442124028920780","215149624363657437922484929731917417210","37867514156452346326986740760781908113","222183624422528106982773505064446576252","291069491497401340471846751945819966083","323223917251683367930741110311073798791","18403397235814300454259003377670222441","134872008201039988041264569341423215953","177640702022945235168216420352199218181","113879128291352974963062731613758716664","19933239194241197540978350586546716750","245383467138744127285303003179184955889","326001593262479683116210744341192136249","151201200353499652464408063935342739827","172582215120833753484026159805828678903","30783840051806744457568375892216035462","88038167991520071126773205738070860505","40192783619291773512338438983331118277","221424299816246942408565640542875951557","5916113629173319018029415570670112244","290432414286531761704770270361060805095","224920701753858603778765707360561748335","333691578320893850762132764586332555380","255679118715834011638776356924563771803","9637449175148878297326849521786678700","2900191331276494887583535642015596987","13912753293743701810876331924825868362","101446507389067663741746203727121836291","5092182401575760448158436481769051228","78172134178391555769734790493933641828","209152032244892839572881788989983566328","286380198406238391078272032151434629154","30527383283422602096787284980783555123","11247223268726087318439216693010282983","42774649623972014715016031940156629294","65774717527263739803776224747876595734","163883418825477740050951133079222839051","31724486513268962269874225092817835453","58640825953397247505305865900669395303","168712411040866165964010099380256112209","315953152171888289537801269542211198193","110119779893672570976909573984440417467","247319429788758275004267526203687853987","217083565178372531805298780806913715671","2319126982271237675221298237637263214","151233742438379964812110924526928359940","314123323461200580056182813221999011344","101544941233740050352686074842487951889","226942897151747738292842826715593120154","328854836869614143130137610250298486310","241137933226780567054813380950841005310","184622039706441227678943503522799979539","326883459483184029125924967618096669793","165489656172682608002436997205450196995","181317148935100078742315232707165458040","219254147037112348770768279595070882864","198775773111772597843052186194354571224","54253094396603683023327363726259777927","206074244124457382909015175945303133578","215715076636292665508551977548961503924","210246945655770628041175383097780003974","35041636026114195342657937436058986843","52488114991414420010222361399879893430","42887715405456392586645118649894794482","267151358152728303260964870808574490966","295589502716072907993460826749349175697","111031422318297434156197505726518874561","100796941578235663691349192811866411238","185076579164073168711499010814537770936","9897305032982273739260172744775141366","26816136754012716575760231505021086320","47861304606170835893511053887171932533","45812448866405334550829456506986446318","124226154064331509758495946125328098234","327223246231406435363355841865187930421","13654824939334430689196612698949392138","213569114595933453229262561267807574106","234742182919368639685910261188238282454","36398969570630724873449335017530334830","89460459017334606591288178839697340327"],"threshold":0.9},"id":"CVE-2026-90609-4e5417f9","signature_type":"Line","signature_version":"v1"},{"digest":{"line_hashes":["105668341748784375936048444601661497381","148716304083886404736159906051395179438","333507788344831057281980461550618436063","167755651240568112732193600699833486806","131307465396708341726123088559244716126","306334000837811938979353149634261830437","6348656499965048336015214936067289422","171755878346977172663573355464133479295","136391763172658037986712785569209077462"],"threshold":0.9},"id":"CVE-2026-90609-522fda2b","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/scenegraph/base_scenegraph.c"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/scenegraph/commands.c"},"deprecated":false,"digest":{"line_hashes":["18338864011790866004979176460894329456","67772603066413577908091567069653092573","123394936464620136456372734200001554687","41987364153921571867877910780105801198","314356419965637283597120691318154642304","281698872907481534309761915126316310343","163029304514665856433432131778653150603","112852922152970817244426376348067257015","16482202852593543480457146122382640422","146251124110270106525950113852804063805","10673853558738566635447801969456323255","332576237667675739953344124318433482317","27246929458718933464429137945820028447","144191661868105578777541189136006623482","295685489450405597430200073077303797272"],"threshold":0.9},"id":"CVE-2026-90609-65e7be48","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["330951025480852290243322711281109911524","268958645049925214856556524610513622450","77636670369008926126507289888067489620","212240802830844622881508648532467196082","99973312259619464562119361090553934008"],"threshold":0.9},"id":"CVE-2026-90609-7be9d067","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/isomedia/stbl_read.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_unregister"},"deprecated":false,"digest":{"function_hash":"297281011097424578928675254672104782429","length":2056},"id":"CVE-2026-90609-7c863735"},{"target":{"file":"src/scenegraph/base_scenegraph.c","function":"gf_node_get_name_and_id"},"deprecated":false,"digest":{"function_hash":"328474621599003302468564523322295207815","length":523},"id":"CVE-2026-90609-8ccd4282","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a"},{"digest":{"function_hash":"116808008205299623724416564895384631922","length":4872},"id":"CVE-2026-90609-914e8961","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/isomedia/stbl_read.c","function":"stbl_GetSampleInfos"},"deprecated":false},{"id":"CVE-2026-90609-b3340768","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/bifs/memory_decoder.c","function":"BM_SetCommandNode"},"deprecated":false,"digest":{"function_hash":"144823296414848606497376621830204273614","length":112}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/filters/reframe_av1.c","function":"av1dmx_finalize"},"deprecated":false,"digest":{"function_hash":"77443310539649747089950137094885543730","length":850},"id":"CVE-2026-90609-c950a62a"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a","target":{"file":"src/bifs/memory_decoder.c","function":"BM_SceneReplace"},"deprecated":false,"digest":{"length":2127,"function_hash":"149210170149027857112913617042760274831"},"id":"CVE-2026-90609-cee88015"},{"target":{"file":"src/bifs/memory_decoder.c"},"deprecated":false,"digest":{"line_hashes":["97569568486296816099576400378578043672","74676460320029070107128333646053296250","180686892485981921186842681732466959691","186435786590208089846954081251170838004","58043030319113911406377195596333465346","267352510094796094311561905687109302706","275112358198120634208418847559781555842"],"threshold":0.9},"id":"CVE-2026-90609-dccad5c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a"},{"target":{"file":"src/scenegraph/mpeg4_nodes.c","function":"gf_sg_mpeg4_node_get_child_ndt"},"deprecated":false,"digest":{"function_hash":"41207922805155943257858638291999689045","length":2897},"id":"CVE-2026-90609-ec0077f6","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/49dee5cad329cfed310c1682703df7daa47df31a"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}]}