CVE-2026-90576 | GPAC up to f1219cde MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference (Issue 3815)

September 12, 2026 Yanac

A vulnerability, which was classified as problematic, was found in GPAC up to f1219cde. Affected is the function gf_node_list_add_child of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to null pointer dereference.

This vulnerability is referenced as CVE-2026-90576. The attack can only be performed from a local environment. Furthermore, an exploit is available.

You should upgrade the affected component.VulDB Recent EntriesRead More