PT-2026-4718 · Gpac+1 · Gpac+1

Kery Qi · Published 2026-01-26 · Updated 2026-02-16 · CVE-2026-1415

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GPAC versions up to 2.4.0

Description A flaw exists in GPAC where manipulation of the Name argument within the gf media export webvtt metadata function, located in the src/media tools/media export.c file, can lead to a null pointer dereference. This issue requires local access to exploit. The exploit is publicly available.

Recommendations Deploy the patch with identifier af951b892dfbaaa38336ba2eba6d6a42c25810fd.

Exploit

Fix

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

BDU:2026-03616

CVE-2026-1415

Affected Products

Gpac

Red Os

References · 20

• 🔥 https://github.com/gpac/gpac/issues/3428#issue-3802223345 · Exploit
• https://github.com/gpac/gpac/issues/3428 · Vendor Advisory
• https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd · Patch
• https://bdu.fstec.ru/vul/2026-03616 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1415 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-1415 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1415 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1415 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1415 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1415 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-1415 · Vendor Advisory
• https://vuldb.com/?ctiid.342804 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-gpac-cve-2026-1415-7.3 · Note
• https://github.com/gpac/gpac · Note
• https://t.me/CVEtracker/42977 · Telegram Post