GPAC MP4Box BIFS parser NULL deref bug (CWE-476) with ASan POC and patch

GPAC MP4Box Vulnerability Summary Vulnerability Overview Vulnerability Name: Invalid child node list read in in GPAC MP4Box Project: GPAC (https://github.com/gpac/gpac) Affected Versions: Vulnerable in commit ; fixed in commit Date Reported: 2026-07-27 Severity: MEDIUM OWASP: N/A - Native File Parsing Memory Safety CWE: CWE-476 - NULL pointer dereference Scope of Impact Affected Files: - ( ) - ( ) - (trigger path via MP4Box) Root Cause: When parsing a malformed indexed BIFS command, treats the selected target field as a child node list without first verifying that the field is actually the field. This results in an invalid pointer being passed to , causing a dereference (segfault) at a near-NULL address. Impact: A crafted BT/BIFS scene can cause a crash during MP4Box import, leading to service disruption. Any application that exposes the affected GPAC BIFS scene parsing path can be terminated by a malformed command. Remediation Apply the upstream fix commit , or upgrade to a newer version that includes this fix. Patch Details: Verify that the target field is interpreted as the field, and return a parser error if the child node is invalid. Add regression tests for malformed input, specifically targeting indexed commands with non-child fields and out-of-range child node indices. POC / Reproduction Code Reproduction Steps (assuming the directory is located next to the cloned directory): Expected Result (on the vulnerable commit): Fix Patch Code: References GPAC Issue #3802: gpac/gpac#3802 Fix Commit: https://github.com/gpac/gpac/commit/afca81c1181686859415de1ae6f478705d975 Related Early Issue #3768: gpac/gpac#3768 Vulnerable Commit: https://github.com/gpac/gpac/commit/7219cde1a892a913ec85d797324ce4c2015 GPAC Repository: https://github.com/gpac/gpac Reproduction Materials: https://github.com/Echo6/CVE_submit Notes The original report indicates that this behavior may be an incomplete fix for Issue #3768. Issue #3802 was directly closed by commit .

Goal Reached Thanks to every supporter — we hit 100%!

GPAC MP4Box BIFS parser NULL deref bug (CWE-476) with ASan POC and patch

More from this source