EUVD-2026-41801
GHSA-2287-vqgx-x5qm
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with low privileges to supply crafted media; impact is solely a process crash with no confidentiality or integrity effect and unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in GPAC 26.02.0. This affects the function nhmldump_send_frame of the file src/filters/write_nhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be used. This patch is called bd1d94e70e3bef364c07c5a1d94eca5c9f56e160. A patch should be applied to remediate this issue. The project explains: "I would consider most of these more as bugs than vulns but anyway they're good to fix".
AnalysisAI
Null pointer dereference in GPAC 26.02.0's nhmldump_send_frame function (src/filters/write_nhml.c) allows a local, low-privileged attacker to crash the application by supplying crafted media input to the NHML write filter. Impact is strictly limited to availability - a process-level denial of service with no confidentiality or integrity implications. A publicly available proof-of-concept exploit exists (GitHub issue #3596), though the vendor itself characterizes this class of issue as 'more bugs than vulns,' contextualizing it as a robustness fix rather than an urgent security incident.
Technical ContextAI
GPAC is an open-source multimedia framework for packaging, streaming, and processing audio/video content, widely used in media research and tooling. The vulnerable component is the NHML (Node Hierarchical Media Language) file writer within GPAC's filter pipeline architecture. The function nhmldump_send_frame in src/filters/write_nhml.c dereferences a pointer without first validating it for null, the canonical CWE-476 (NULL Pointer Dereference) pattern. When a crafted or malformed media frame reaches this code path, the dereference triggers a segmentation fault and crashes the GPAC process. The CPE string cpe:2.3:a:n/a:gpac:*:*:*:*:*:*:*:* uses a wildcard version field, meaning adjacent releases to 26.02.0 may also be affected, though the description specifically names 26.02.0. The CVSS 4.0 supplemental metric E:P confirms a proof-of-concept exploit has been published.
RemediationAI
Apply the upstream fix by incorporating commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 from the GPAC GitHub repository (https://github.com/gpac/gpac/commit/bd1d94e70e3bef364c07c5a1d94eca5c9f56e160). Note that this is a source-level commit fix - a specific tagged patched release version has not been independently confirmed, so organizations building from source should cherry-pick this commit. For deployments unable to patch immediately, the primary compensating control is restricting who can supply media files to GPAC processing pipelines, since exploitation requires both local access and attacker-controlled media input. Disabling or avoiding use of the NHML write filter (nhmldump) specifically would eliminate exposure to this code path with minimal trade-off if that output format is not required. Given the impact is a process crash with no data exposure, urgency is low for most environments. Additional context is available at https://vuldb.com/cve/CVE-2026-14790.
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.8), this vulnera
GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. Rated crit
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Rated critical severity (CVSS 9.8), this vulnerabilit
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to e
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. Rated critical severity (CVSS 9.8), this
An issue was discovered in MP4Box in GPAC 0.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.1), this vulnerability
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.c. Rated high severit
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Rated high sev
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today