Executive brief
GPAC is an open-source multimedia framework used for video streaming and media transcoding. A flaw in its media file handling component allows a local user to cause the application to crash by providing specially crafted input. This results in a denial-of-service, potentially interrupting media processing workflows or automated transcoding services.
Technical details
A null pointer dereference vulnerability exists in GPAC 26.02.0 within the `nhmldump_send_frame` function in `src/filters/write_nhml.c`. The issue occurs when the code assumes a required state is present and dereferences a pointer that remains NULL during the processing of malformed input or partially initialized objects, specifically when handling STPP (Sub-Title Putaway) data. An attacker with local access can trigger this by delivering crafted media files or graph descriptions, leading to a process crash (Denial of Service). The vulnerability was identified via fuzzing and confirmed with UndefinedBehaviorSanitizer (UBSan). A patch has been released in commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160.
Affected products
- GPAC GPAC 26.02.0
Timeline
- 2026-06-04: disclosed: Issue reported on GitHub repository
- 2026-07-06: advisory: CVE published to NVD
- 2026-07-06: patched: Patch commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 identified