CVE-2026-1415
📋 TL;DR
A null pointer dereference vulnerability exists in GPAC multimedia framework versions up to 2.4.0. Attackers with local access can crash the application by manipulating the Name argument in the gf_media_export_webvtt_metadata function. This affects systems running vulnerable GPAC versions for media processing.
💻 Affected Systems
- GPAC Multimedia Framework
📦 What is this software?
Gpac by Gpac
⚠️ Risk & Real-World Impact
Worst Case
Application crash leading to denial of service for media processing functionality, potentially disrupting workflows that depend on GPAC.
Likely Case
Local user causes application crash, interrupting media processing tasks but no privilege escalation or remote impact.
If Mitigated
Minimal impact with proper access controls limiting local user privileges and application isolation.
🎯 Exploit Status
Exploit requires local access and specific manipulation of WebVTT metadata processing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit af951b892dfbaaa38336ba2eba6d6a42c25810fd
Vendor Advisory: https://github.com/gpac/gpac/issues/3428
Restart Required: Yes
Instructions:
1. Update GPAC to version after commit af951b892dfbaaa38336ba2eba6d6a42c25810fd
2. Rebuild from source if using custom builds
3. Restart any services using GPAC
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running GPAC to prevent exploitation
Disable WebVTT processing
allAvoid processing WebVTT metadata if not required
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for application crashes and investigate unauthorized local access attempts
🔍 How to Verify
Check if Vulnerable:
Check GPAC version with 'gpac -version' or verify source code contains vulnerable function in src/media_tools/media_export.cCheck Version:
gpac -version 2>&1 | head -1Verify Fix Applied:
Verify GPAC version is newer than 2.4.0 or contains commit af951b892dfbaaa38336ba2eba6d6a42c25810fd📡 Detection & Monitoring
Log Indicators:
- GPAC application crashes
- Segmentation fault errors in system logs
- Unexpected termination of media processing tasks
Network Indicators:
- No network indicators - local exploit only
SIEM Query:
source="*syslog*" AND "gpac" AND ("segmentation fault" OR "crash" OR "SIGSEGV")🔗 References
- https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd
- https://github.com/gpac/gpac/
- https://github.com/gpac/gpac/issues/3428
- https://github.com/gpac/gpac/issues/3428#issue-3802223345
- https://vuldb.com/?ctiid.342804
- https://vuldb.com/?id.342804
- https://vuldb.com/?submit.736541
