EUVD-2026-84855
GHSA-gphj-3jjc-cfmg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious file with NULL SFImage PROTO field
-
DeliveryDeliver file to victim
-
ExploitVictim opens file in GPAC tool
-
ExecutionClone routine dereferences NULL pointer
-
ImpactApplication crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open or process an attacker-supplied, specially crafted input file (VRML/scene or media file) with a GPAC-based application; per CVSS UI:R this user interaction is mandatory and there is no remote or unauthenticated network path. The specific trigger is a PROTO node containing a default SFImage field whose source pixel pointer is NULL, which the cloning routine gf_sg_vrml_field_clone() dereferences. Limiting factors: local attack vector (AV:L), required user interaction, and impact confined to a single-process crash (availability only) - there is no code execution, data disclosure, or privilege gain. |
| Impact | All signals converge on this being a low-priority, availability-only issue rather than a serious threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5 MEDIUM) describes a local vulnerability requiring the victim to open a crafted file, with impact limited strictly to availability (application crash) - no confidentiality or integrity loss. This is corroborated by CWE-476 (NULL pointer dereference) and the source-code evidence: cloning a PROTO default SFImage field with a NULL source pointer calls memcpy from a NULL source, crashing the process. EPSS is very low at 0.20% (10th percentile), consistent with the local-only, single-process-crash nature. SSVC aligns: Exploitation=poc (proof-of-concept exists, tracked in GitHub issue #3855), Automatable=no, Technical Impact=partial - i.e. a crash, not code execution or system compromise. There is no CISA KEV listing and no evidence of active exploitation. The main caveat: the SSVC 'poc' status implies a public reproducer/crafted file exists (via the linked issue), but this is proof-of-concept, NOT active exploitation. No key signals conflict; the network-vs-local question is unambiguous (AV:L plus UI:R clearly indicate a local file-parsing crash). |
| Exploit ScenarioDerived | An attacker crafts a malicious scene/media file containing a PROTO node whose default SFImage field has a NULL pixel source, then delivers it to a victim who processes it with a GPAC-based tool (e.g. MP4Box or a player). When GPAC clones the field via gf_sg_vrml_field_clone(), it dereferences the NULL source in memcpy and the application crashes. A proof-of-concept reproducer is referenced in the upstream GitHub issue (#3855), but only a denial of service (process crash) results - no code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
Opening a specially crafted VRML/X3D or scene file with a GPAC-based application (GPAC 2d7da22e / 26.08-DEV) crashes the process through a NULL pointer dereference in the scene-graph cloning routine gf_sg_vrml_field_clone(), producing a denial of service. The trigger is a PROTO node whose default SFImage field has a NULL pixel source pointer, and per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) exploitation is local and requires the victim to open an attacker-supplied file, with impact limited to availability - no code execution, data disclosure, or privilege gain. Publicly available exploit code exists, but there is no evidence of active exploitation (not in CISA KEV) and the EPSS score is low at 0.20% (10th percentile), so this is a low-priority availability-only issue.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit c748219af5968fd70f6dc7ebe4d6dd9f495d4425, which adds the missing NULL/size guard before the SFImage pixel memcpy in gf_sg_vrml_field_clone(), or rebuild/upgrade to a GPAC build that incorporates it (no tagged release version was confirmed in the provided data). Where code updates cannot be applied immediately, avoid feeding untrusted VRML/X3D content - particularly files containing PROTO nodes with default SFImage fields - to GPAC-based tooling such as MP4Box or the GPAC player, which removes the attack surface at the cost of breaking legitimate scene-file ingestion, and run those tools with least privilege inside a sandbox/container with memory limits and automatic restart so that a NULL-dereference crash is contained to a single disposable process rather than degrading a shared or long-running service. Because exploitation requires local user interaction (AV:L, UI:R) and yields only a process crash, network-perimeter controls provide no meaningful benefit; the priority is patch deployment plus input-source discipline. Consult the GPAC issue at https://github.com/gpac/gpac/issues/3855 and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-88339 for updated fix-version guidance.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GPAC is an open-source multimedia framework whose scene-graph subsystem (src/scenegraph/vrml_tools.c) implements VRML/X3D node and field handling; gf_sg_vrml_field_clone() performs a deep copy of a field value between scene-graph nodes, and for the SFImage type it computed a byte size, allocated a destination buffer, and memcpy'd from ((SFImage *)orig)->pixels without first verifying that the source pixel pointer was non-NULL. A PROTO definition that declares a default SFImage field while leaving its pixel buffer unset therefore supplies a NULL source, and the unconditioned memcpy dereferences it - a classic CWE-476 NULL pointer dereference. The upstream fix in commit c748219af5968fd70f6dc7ebe4d6dd9f495d4425 guards the copy with 'if (((SFImage *)orig)->pixels && size > 0)' and otherwise assigns NULL to the destination's pixel pointer, eliminating the invalid dereference while preserving the correct NULL-valued clone semantics. The CPE string supplied with the report is unpopulated (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*), so product/version identification rests on the referenced GPAC issue and the source path rather than authoritative CPE enumeration, and the CVSS vector confirms a local, unauthenticated-but-user-assisted attack (PR:N, UI:R) with high availability impact only.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file must be parsed by the victim (AV:L, UI:R); no auth needed to craft the file (PR:N); NULL deref causes only a crash, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB