PT-2026-4719 · Gpac+1 · Gpac+1

Kery Qi · Published 2026-01-26 · Updated 2026-02-16 · CVE-2026-1416

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GPAC versions up to 2.4.0

Description A security flaw exists in GPAC due to a null pointer dereference in the DumpMovieInfo function located in the applications/mp4box/filedump.c file. This manipulation can be initiated locally. The exploit for this issue has been publicly released and may be used in attacks.

Recommendations Implement the patch d45c264c20addf0c1cc05124ede33f8ffa800e68 to correct this issue.

Exploit

Fix

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

BDU:2026-03619

CVE-2026-1416

Affected Products

Gpac

Red Os

References · 22

• 🔥 https://github.com/gpac/gpac/issues/3427#issue-3802197432 · Exploit
• https://github.com/gpac/gpac/issues/3427 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03619 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1416 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1416 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-1416 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1416 · Security Note
• https://github.com/enocknt/gpac/commit/d45c264c20addf0c1cc05124ede33f8ffa800e68 · Patch
• https://ubuntu.com/security/CVE-2026-1416 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1416 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1416 · Security Note
• https://vuldb.com/?ctiid.342805 · Note
• https://vuldb.com/?submit.736542 · Note
• https://t.me/CVEtracker/42978 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-gpac-cve-2026-1416-8.0 · Note