CVE-2026-9567

LOW

GPAC MP4Box isom_intern.c MergeFragment null pointer dereference

Title source: cna
STIX 2.1

Description

A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isom_intern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.

References (7)

Core 7
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-365629 | GPAC MP4Box isom_intern.c MergeFragment null pointer dereference
https://vuldb.com/vuln/365629
Signature, Permissions Required signature permissions-required
VDB-365629 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/365629/cti
Third Party Advisory third-party-advisory
Submit #816075 | GPAC MP4Box <= 2.4.0 (master commit 7508ccc and earlier) Null pointer dereference (Denial of Service)
https://vuldb.com/submit/816075
Issue Tracking issue-tracking
https://github.com/gpac/gpac/issues/3549

Scores

CVSS v3 3.3
EPSS 0.0011
EPSS Percentile 1.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-404 CWE-476
Status published
Products (5)
None/GPAC 2.0
None/GPAC 2.1
None/GPAC 2.2
None/GPAC 2.3
None/GPAC 2.4.0
Published May 26, 2026
Tracked Since May 26, 2026