CVE-2026-88339 Details
Description
A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.
A NULL pointer dereference vulnerability has been identified in GPAC version 2d7da22e (26.08-DEV). The issue arises in the 'gf_sg_vrml_field_clone()' function when the BIFS scene decoder attempts to clone a PROTO node's default 'SFImage' field. If the source 'pixels' pointer is NULL, the function erroneously proceeds to copy image data, leading to a crash. This vulnerability can be exploited by sending a specially crafted input file, causing the application to crash and creating a denial-of-service condition.
A fix has been implemented in GPAC. The vulnerability has been addressed by adding a NULL check for the 'pixels' pointer before performing the memory copy, and by ensuring that the 'pixels' pointer is set to NULL if no data is available.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 22, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gpac/gpac/issues/3855 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/gpac/gpac/issues/3855 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/makesoftwaresafe/gpac/commit/c748219af5968fd70f6dc7ebe4d6dd9f495d4425 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| GPAC | 2d7da22e5c7300b1564623d82aceaf7a7424dea1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 22, 2026 | New CVE Received | [email protected] |