What is the CVSS score of CVE-2026-50810?

CVE-2026-50810 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

GPAC CVE-2026-50810

EUVD-2026-42156 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-07-07 mitre

GHSA-vcxc-wc98-2q7w

Denial Of Service Null Pointer Dereference N A

5.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local file-triggered crash requiring user to open crafted media; no privileges needed, no data exposure, availability impact only.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 17:12 vuln.today

CVSS changed

Jul 09, 2026 - 16:22 NVD

5.5 (None) 5.5 (MEDIUM)

CVE Published

Jul 07, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A NULL pointer dereference in smooth_parse_stream_index() in src/media_tools/mpd.c in GPAC master HEAD before commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 allows attackers to cause a denial of service

AnalysisAI

NULL pointer dereference in GPAC's smooth_parse_stream_index() function crashes the application when processing a maliciously crafted MPEG-DASH or Smooth Streaming media file, resulting in denial of service. Affected versions are all GPAC master HEAD builds prior to commit b35c61f104b85fbb16520ac2838d5d2ef70845b5. Exploitation requires local access and user interaction to open a crafted file; a proof-of-concept is publicly available via GitHub Gist, though EPSS sits at 0.17% (7th percentile) and no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

GPAC is an open-source multimedia framework widely used for MPEG-4/ISOBMFF processing, MPEG-DASH packaging, and media analysis. The vulnerable function smooth_parse_stream_index() resides in src/media_tools/mpd.c, which is responsible for parsing MPD (Media Presentation Description) manifests and related Smooth Streaming index structures used in adaptive bitrate streaming workflows. CWE-476 (NULL Pointer Dereference) indicates that the parser fails to validate a pointer before dereferencing it during stream index processing - a class of flaw that commonly arises when optional or malformed fields in a media container are absent and the code assumes their presence. CPE data returned as n/a is unhelpful for precise version scoping; affected scope is defined solely by the upstream commit reference.

RemediationAI

The upstream fix is available as commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 in the GPAC GitHub repository (https://github.com/gpac/gpac/commit/b35c61f104b85fbb16520ac2838d5d2ef70845b5); no tagged stable release incorporating this fix has been independently confirmed at time of analysis. Organizations building GPAC from source should rebase to or past this commit. As a compensating control, restrict GPAC-based tooling from processing untrusted or externally sourced MPD/Smooth Streaming media files - input validation at the pipeline boundary reduces exposure without disabling the tool entirely. Sandboxing GPAC processes (e.g., via seccomp profiles or containerization) limits the impact of a crash to a single process rather than a broader pipeline. No confidentiality or integrity workarounds are required given the DoS-only impact.