MEDIUMCVSS 5.5
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in src/scenegraph/base_scenegraph.c that lets attackers crash applications. Attackers can supply a crafted XMT scene referencing a never-created node to crash MP4Box or GPAC scene loader applications, causing denial of service.
Published 2026-11-15 · last modified 2026-11-15
| Vendor | Product |
|---|---|
| gpac | gpac |
Ncerio by BeyondNets · data from NVD, CISA KEV, EPSS.