Description
A flaw has been found in GPAC 26.02.0. This affects the function nhmldump_send_frame of the file src/filters/write_nhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be used. This patch is called bd1d94e70e3bef364c07c5a1d94eca5c9f56e160. A patch should be applied to remediate this issue. The project explains: "I would consider most of these more as bugs than vulns but anyway they're good to fix".
Published: 2026-07-06
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the GPAC 26.02.0 Media File Handler causes the function nhmldump_send_frame to dereference a null pointer (CWE‑476) when processing certain media files. The crash shuts down the GPAC process but does not provide remote code execution. The disruption can deny service to applications that rely on GPAC for media handling.

Affected Systems

The vulnerability affects the GPAC project’s Media File Handler component in version 26.02.0. All builds that include the unpatched write_nhml.c code are impacted.

Risk and Exploitability

The CVSS score of 4.8 places the issue in the medium severity range. An EPSS score of < 1% indicates a very low probability of exploitation. The flaw requires local access, enabling processed by GPAC. No remote exploitation path is documented, and the vulnerability is not listed in the CISA KEV catalog, so the overall risk is moderate for environments where local file access is possible. The exploit has been published and may be used.

Generated by OpenCVE AI on July 26, 2026 at 21:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update GPAC to bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 or newer releases with the fix.
  • Restart any services or applications updated binary is loaded and running.
  • Apply strict input validation or sandboxing for media files processed by GPAC to prevent accidental null‑pointer dereferences and monitor logs for unexpected crashes.

Generated by OpenCVE AI on July 26, 2026 at 21:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 03:00:00 +0000

Type Values Removed Values Added
Description A flaw has been found in GPAC 26.02.0. This affects the function nhmldump_send_frame of the file src/filters/write_nhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be used. This patch is called bd1d94e70e3bef364c07c5a1d94eca5c9f56e160. A patch should be applied to remediate this issue. The project explains: "I would consider most of these more as bugs than vulns but anyway they're good to fix".
Title GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-404
CWE-476
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T15:20:48.022Z

Reserved: 2026-07-05T16:07:15.466Z

Link: CVE-2026-14790

cve-icon Vulnrichment

Updated: 2026-07-06T15:20:22.326Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T21:15:03Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release

  • CWE-476

    NULL Pointer Dereference