Executive brief
A vulnerability exists in GPAC's MP4Box, a popular tool for processing multimedia files like MP4s. By tricking a user into processing a specially crafted file, an attacker can cause the application to crash. This results in a denial-of-service, potentially disrupting media processing workflows or automated video conversion services.
Technical details
A NULL pointer dereference exists in the gf_filter_pid_resolve_file_template_ex function within /filter_core/filter_pid.c of GPAC Project/MP4Box. The vulnerability is triggered when the application processes files with specially crafted metadata containing special characters, leading to a strncmp() operation on an uninitialized NULL pointer. This results in a segmentation fault and application crash. The issue is reachable via the MP4Box command-line utility when performing operations such as DASHing. A fix has been committed to the GPAC repository to address this and other fuzzing-related issues.
Affected products
- GPAC GPAC Project/MP4Box before 26.02.0
Timeline
- 2026-06-03: advisory: NVD publication date
- 2026-06-03: disclosed