Executive brief
A vulnerability exists in MP4Box, a popular tool for processing multimedia files. By tricking a user into opening a specially crafted media file, an attacker can cause the application to crash. This results in a denial of service, potentially disrupting media processing workflows or automated video conversion services.
Technical details
A NULL pointer dereference exists in the gf_filter_in_parent_chain function within /filter_core/filter_pid.c of GPAC. The vulnerability is triggered during Packet ID (PID) chain validation when the code fails to verify if a parent filter pointer is valid before accessing its memory. An attacker can exploit this by providing a malformed MPEG-2 TS or similar media file, leading to a segmentation fault (SEGV) and application crash. The issue was addressed by adding a NULL check for pidi->pid before the recursive call in gf_filter_in_parent_chain.
Affected products
- GPAC GPAC Project / MP4Box before 26.02.0
Timeline
- 2026-06-25: advisory: NVD publication date
- 2026-06-24: disclosed: Initial CVE receipt from MITRE
References
- https://github.com/gpac/gpac/commit/b8d80b44718de10b101e1d7fc17c84d69feb092e
- https://github.com/gpac/gpac/issues/3285
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/36_gf_filter_in_parent_chain_filter_core_filter_pid_c_2145
- https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/README.md
- https://infosec.exchange/@sigdevel/116780471059317580