{"id":"CVE-2026-128239","kind":"vulnerability","aliases":["CVE-2026-128239"],"related":[],"title":"GPAC: crafted scene file crashes MP4Box with a NULL pointer","description":"GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a non-existent group, crashing tools like MP4Box during chapter import for denial of service.","summary":"GPAC, a multimedia framework, has a NULL pointer dereference in its MPEG-4 Form constraint handling. A crafted XMT scene file that references a missing group makes the process crash, which is a denial of service.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GPAC","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["gpac","media-pipelines","mp4box","package"],"not_affected_if":["no-untrusted-xmt-input"],"how_to_check":"- Run `MP4Box -version` or `gpac -version` to see the installed GPAC version\n- Check whether tools that import untrusted XMT scene files, such as MP4Box chapter import, are used on your systems","fix":"- GPAC: move to a release later than `26.07.0`; the sources do not name the fixed version","status":"open","published_at":"2026-11-13T10:18:11+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","triaged_at":"2026-11-13T10:54:56+00:00","updated_at":"2026-11-13T10:54:56+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:54:56Z","model":"claude-haiku-5-5","output":{"fix":"- GPAC: move to a release later than `26.07.0`; the sources do not name the fixed version","reach":"local","title":"GPAC: crafted scene file crashes MP4Box with a NULL pointer","impact":"low","summary":"GPAC, a multimedia framework, has a NULL pointer dereference in its MPEG-4 Form constraint handling. A crafted XMT scene file that references a missing group makes the process crash, which is a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-pipelines"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Process crashes, causing denial of service during file import","analyst_note":"","how_to_check":"- Run `MP4Box -version` or `gpac -version` to see the installed GPAC version\n- Check whether tools that import untrusted XMT scene files, such as MP4Box chapter import, are used on your systems","plain_action":"","product_name":"GPAC","needs_analyst":false,"not_affected_if":["no-untrusted-xmt-input"],"who_is_affected":"Systems that run GPAC tools such as MP4Box and import XMT scene files from untrusted sources are exposed. Installations that only process trusted media files, or that do not use the XMT Form constraint path, are unlikely to be affected. The sources do not state default configuration details.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4638,"output_tokens":537,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128239':13A,16A '-2026':12A,15A '-4':36B,72C '26.07.0':62C 'attack':82C,90C 'chapter':111C 'constraint':38B,76C,99C 'contain':63C 'craft':2A,41B,94C 'crash':5A,53B,83C,106C 'cve':11A,14A 'denial':57B,114C 'derefer':32B,67C 'exist':104C 'file':4A,44B 'form':37B,73C,98C 'framework':27B 'gpac':1A,17A,18B,24B,60C 'group':49B,88C,105C 'handl':39B 'handler':77C 'import':112C 'let':81C 'like':108C 'lookup':89C 'make':50B 'media':20B 'media-pipelin':19B 'miss':48B 'mp4box':6A,22B,109C 'mpeg':35B,71C 'multimedia':26B 'non':103C 'non-exist':102C 'null':9A,30B,65C 'packag':23B 'pipelin':21B 'pointer':10A,31B,66C 'process':52B,85C 'refer':46B,100C 'scene':3A,43B,96C 'servic':59B,116C 'spatial':75C 'spatial-constraint':74C 'src/compositor/mpeg4_form.c':79C 'suppli':92C 'tool':107C 'uncheck':87C 'via':86C 'vulner':68C 'whose':97C 'xmt':42B,95C","nicknames":[],"mitigations":[],"who_affected":"Systems that run GPAC tools such as MP4Box and import XMT scene files from untrusted sources are exposed. Installations that only process trusted media files, or that do not use the XMT Form constraint path, are unlikely to be affected. The sources do not state default configuration details.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["gpac"],"ptokens":["gpac"],"labels":["gpac","mediapipelines","medium","mp4box","package","vendor"],"campaign_type":null,"search_a":"'-128239':13A,16A '-2026':12A,15A 'craft':2A 'crash':5A 'cve':11A,14A 'file':4A 'gpac':1A,17A 'mp4box':6A 'null':9A 'pointer':10A 'scene':3A","search_b":"'-4':36B 'constraint':38B 'craft':41B 'crash':53B 'denial':57B 'derefer':32B 'file':44B 'form':37B 'framework':27B 'gpac':18B,24B 'group':49B 'handl':39B 'make':50B 'media':20B 'media-pipelin':19B 'miss':48B 'mp4box':22B 'mpeg':35B 'multimedia':26B 'null':30B 'packag':23B 'pipelin':21B 'pointer':31B 'process':52B 'refer':46B 'scene':43B 'servic':59B 'xmt':42B","search_c":"'-4':72C '26.07.0':62C 'attack':82C,90C 'chapter':111C 'constraint':76C,99C 'contain':63C 'craft':94C 'crash':83C,106C 'denial':114C 'derefer':67C 'exist':104C 'form':73C,98C 'gpac':60C 'group':88C,105C 'handler':77C 'import':112C 'let':81C 'like':108C 'lookup':89C 'mp4box':109C 'mpeg':71C 'non':103C 'non-exist':102C 'null':65C 'pointer':66C 'process':85C 'refer':100C 'scene':96C 'servic':116C 'spatial':75C 'spatial-constraint':74C 'src/compositor/mpeg4_form.c':79C 'suppli':92C 'tool':107C 'uncheck':87C 'via':86C 'vulner':68C 'whose':97C 'xmt':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:11+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128239","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128239","severity":null,"published_at":"2026-11-13T10:18:11+00:00","modified_at":"2026-11-13T10:18:11+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","fetched_at":"2026-11-13T10:47:33+00:00","note":null}],"documents":[{"id":145428,"url":"https://github.com/gpac/gpac/commit/bc416b997622e43de65afab3bae9b7d05d72f2b0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":145429,"url":"https://www.vulncheck.com/advisories/gpac-through-26.07.0-null-pointer-dereference-via-mpeg-4-form-handlers","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}