CVE catalog

CVE-2026-88339

UBUNTU-CVE-2026-88339

[CVE catalog]

Severity
Unknown
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.17% · Oct 25, 2026

A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occurs when cloning a PROTO default SFImage field with a NULL source pointer. An attacker can provide a specially crafted input file that triggers the condition, resulting in application crash and denial of service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Ubuntugpacpro0.5.0+svn4288~dfsg1-1ubuntu1vulnerable
Ubuntugpacpro0.5.0+svn4288~dfsg1-4vulnerable
Ubuntugpacpro0.5.0+svn4288~dfsg1-4ubuntu1vulnerable
Ubuntugpacpro0.5.0+svn4288~dfsg1-4ubuntu1+esm1vulnerable
Ubuntugpacpro0.5.0+svn4288~dfsg1-4ubuntu1+esm2vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-1build1vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1+esm2vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-3vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1+esm1vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-4ubuntu1vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-5vulnerable
Ubuntugpacpro0.5.2-426-gc5ad4e4+dfsg5-5ubuntu0.1~esm2vulnerable
Ubuntugpacpro1.0.1+dfsg1-4vulnerable
Ubuntugpacpro1.0.1+dfsg1-5vulnerable
Ubuntugpacpro2.0.0+dfsg1-2vulnerable
Ubuntugpacpro2.0.0+dfsg1-2ubuntu0.1~esm2vulnerable
Ubuntugpacpro2.2.1+dfsg1-3vulnerable
Ubuntugpacpro2.2.1+dfsg1-3.1vulnerable
Ubuntugpacpro2.2.1+dfsg1-3.1build1vulnerable
Ubuntugpacpro2.2.1+dfsg1-3.1build2vulnerable
Ubuntugpacpro2.2.1+dfsg1-3.1ubuntu0.1~esm2vulnerable

Fixed-version evidence

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database]