A vulnerability tracked as CVE-2026-9567 affects GPAC versions up to 2.4.0, leading to a NULL pointer dereference and potential Denial of Service (DoS) during media processing with MP4Box.

A low-severity security flaw has been identified in GPAC, the open-source multimedia framework used for creating and packaging media content. The vulnerability, designated CVE-2026-9567, is rooted in the MP4Box component and can be triggered locally to cause a NULL pointer dereference.[1]

What Is the Vulnerability?

CVE-2026-9567 is a NULL pointer dereference vulnerability affecting GPAC versions up to 2.4.0.[1] The flaw resides specifically within the MergeFragment function, which is located in the src/isomedia/isom_intern.c file of the MP4Box component.[1]

When an attacker provides specially manipulated input to the application, it fails to properly validate a pointer before dereferencing it.[2] This leads to an immediate application crash, rendering the MP4Box utility temporarily unavailable for processing tasks, thereby resulting in a local Denial of Service (DoS).[2]

Technical Details

The vulnerability (CWE-476: NULL Pointer Dereference) requires a local attack vector.[1] This means an attacker must already have access to the system running the GPAC software or must deceive a user into executing MP4Box locally against a maliciously crafted file.[1]

A Proof of Concept (PoC) exploit has been released to the public, demonstrating how the manipulation of input processed by the MergeFragment function triggers the crash.[2]

Severity and Exploitation

The vulnerability has been assigned a CVSS v3.1 base score of 3.3 (Low) by VulDB, utilizing the vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.[2]

This low score reflects the localized nature of the attack (it cannot be triggered remotely over a network without prior access or user interaction) and the fact that the impact is limited strictly to availability (causing a crash), with no impact on confidentiality or integrity.[2] There are no reports of active exploitation in the wild, nor is the vulnerability listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.[1]

Affected Products and Versions

The flaw is confirmed to affect the following:[1]

• Product: GPAC
• Component: MP4Box
• Versions: Up to and including version 2.4.0

Mitigation and Patch

To resolve the vulnerability, users should apply the software patch that corrects the pointer validation logic in isom_intern.c. The official fixing commit is identified by the hash 525bf1af642c30af04e4df5345e6d798c0a4d8a1.[1]

Users and administrators compiling GPAC from source are advised to pull the latest changes that include this commit. Those relying on packaged versions from Linux distributions (such as Ubuntu or Debian) should monitor their respective security trackers for updated packages incorporating the fix.[3]

Security Takeaway

While a local DoS in a media processing tool like MP4Box generally presents a low risk to overarching enterprise security, the existence of a public PoC means the crash can be reliably reproduced. Environments that process untrusted media files automatically using GPAC should prioritize patching to prevent pipeline disruptions.