CVE-2026-90792

Name of the Vulnerable Software and Affected Versions GPAC versions prior to abi-16.23

Description A remote flaw exists in the MP4Box component within the gf node list get child() function of the scenegraph/base scenegraph.c file. Manipulation of the Target argument leads to a null pointer dereference, which occurs when a program attempts to read or write to a memory address that is null, typically resulting in a crash.

Recommendations Upgrade to version abi-16.23.