GPAC CVE-2026-9567

GPAC is an open-source multimedia framework; its MP4Box command-line tool reads and writes ISOBMFF/MP4 container files. The affected code path is in src/isomedia/isom_intern.c, specifically the MergeFragment function, which merges movie fragment boxes (moof) into a main ISOFile structure. During this merge, GPAC iterates over child boxes including GF_ProtectionSystemHeaderBox (PSSH), which carries DRM system-specific data for encrypted content. The pre-patch code unconditionally reads private_data_size and then calls memmove to copy private_data without first checking whether the pointer is non-null and the size is non-zero. A crafted MP4 file that omits or nulls out the PSSH private_data field therefore causes a null pointer dereference when memmove is called. The assigned CWE is CWE-404 (Improper Resource Shutdown or Release); however, the commit diff and description more precisely match CWE-476 (Null Pointer Dereference) - this classification discrepancy should be noted when tracking the issue in vulnerability management systems. The fix (commit 525bf1af642c30af04e4df5345e6d798c0a4d8a1 on the makesoftwaresafe/gpac fork) wraps the copy block in a conditional that guards on both private_data being non-null and private_data_size being non-zero.