CVE-2026-1416

LOW

gpac < 2.4.0 - Null Pointer Dereference in DumpMovieInfo Function

Title source: llm

Description

A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as d45c264c20addf0c1cc05124ede33f8ffa800e68. It is advisable to implement a patch to correct this issue.

References (7)

Core 7

Core References

Third Party Advisory, VDB Entry vdb-entry technical-description

https://vuldb.com/?id.342805

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.342805

Third Party Advisory, VDB Entry third-party-advisory

https://vuldb.com/?submit.736542

Exploit, Issue Tracking, Mitigation, Vendor Advisory issue-tracking

https://github.com/gpac/gpac/issues/3427

Exploit, Issue Tracking, Mitigation, Vendor Advisory exploit issue-tracking

https://github.com/gpac/gpac/issues/3427#issue-3802197432

Patch patch

https://github.com/enocknt/gpac/commit/d45c264c20addf0c1cc05124ede33f8ffa800e68

View Patch ZIP pw:eip

Various Sources product

https://github.com/gpac/gpac/

Scores

CVSS v3 3.3

EPSS 0.0020

EPSS Percentile 9.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-404 CWE-476

Status published

Products (1)

gpac/gpac < 2.4.0

Published Jan 26, 2026

Tracked Since Feb 18, 2026