Null Pointer Dereference in GPAC MP4Box Affects Security of Media Processing
CVE-2026-9567

4.8MEDIUM

Key Information:

Vendor

GPAC

Status
Gpac
Vendor
CVE Published:
26 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-9567?

A security flaw within the GPAC MP4Box component, specifically in the MergeFragment function of isom_intern.c, allows for a null pointer dereference. This vulnerability primarily affects versions up to 2.4.0 and requires local access to successfully exploit. An exploit for this flaw has been publicized, posing risks for denial of service attacks. To mitigate this issue, users are advised to apply the patch identified as commit 525bf1af642c30af04e4df5345e6d798c0a4d8a1.

Affected Version(s)

GPAC 2.0

GPAC 2.1

GPAC 2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-9567 - Proof of Concept

References

https://vuldb.com/vuln/365629
vdb-entrytechnical-description
https://vuldb.com/vuln/365629/cti
signaturepermissions-required
https://vuldb.com/submit/816075
third-party-advisory

CVSS V4

Score:
4.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

fczhang (VulDB User)
.