Executive brief
GPAC is an open-source multimedia framework used for packaging and streaming video content. A security flaw in its MP4Box component could allow a local user to cause the application to crash by processing a specially crafted MP4 file. This results in a denial-of-service condition, potentially disrupting media processing workflows or automated transcoding services.
Technical details
A null pointer dereference vulnerability exists in GPAC versions up to 2.4.0 within the MergeFragment function of src/isomedia/isom_intern.c. The issue occurs when the MP4Box component processes a malformed MP4 file where a NULL pointer is passed to a memory function (such as memmove) that expects a non-null argument, specifically regarding the private_data field in the ProtectionSystemHeaderBox. An attacker with local access can exploit this by providing a crafted input file to MP4Box, leading to a SIGABRT and application crash. A patch has been released (commit 525bf1af642c30af04e4df5345e6d798c0a4d8a1) which introduces a null guard to validate the pointer and data size before processing.
Affected products
- GPAC GPAC up to 2.4.0
Timeline
- 2026-04-29: disclosed: Issue reported on GitHub repository
- 2026-05-26: advisory: CVE-2026-9567 published
References
- https://github.com/gpac/gpac/
- https://github.com/gpac/gpac/issues/3549
- https://github.com/makesoftwaresafe/gpac/commit/525bf1af642c30af04e4df5345e6d798c0a4d8a1
- https://github.com/user-attachments/files/27196918/poc.zip
- https://vuldb.com/submit/816075
- https://vuldb.com/vuln/365629
- https://vuldb.com/vuln/365629/cti