NULL Pointer Dereference Vulnerability in yt-dlp-web-ui by Marco Piovanello
CVE-2026-109967

8.7HIGH

Key Information:

Vendor: Marcopiovanello
Status: Yt-dlp-web-ui
Vendor: CVE Published:; 13 October 2026

🔔 Create Marcopiovanello Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-109967?

The yt-dlp-web-ui through version 4.0.0 contains a vulnerability in the Service.Formats JSON-RPC method, which allows unauthenticated remote attackers to exploit a NULL pointer dereference. By sending a specially crafted request that contains a URL parameter with a value such as --version, an attacker can trigger an invalid JSON output. This results in an unrecovered panic, ultimately crashing the server and leading to a denial of service. It is crucial for users to be aware of this vulnerability and apply necessary mitigation measures to safeguard their systems.

Affected Version(s)

yt-dlp-web-ui 0 <= 4.0.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-109967 - Proof of Concept