PT-2026-4720 · Gpac+1 · Gpac+1

Kery Qi · CVE-2026-1417 · Published 2026-01-26 · Updated 2026-02-16

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions GPAC versions prior to 2.4.0

Description A flaw exists in GPAC due to a null pointer dereference in the dump isom rtp function within the applications/mp4box/filedump.c file. This issue can be triggered locally. The exploit for this issue is publicly available.

Recommendations Apply the patch f96bd57c3ccdcde4335a0be28cd3e8fe296993de.

Exploit

Fix

DoS

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

BDU:2026-03620

CVE-2026-1417

Affected Products

Gpac

Red Os

References · 24

• 🔥 https://github.com/gpac/gpac/issues/3426#issue-3802172856 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1417.json · Exploit
• https://github.com/gpac/gpac/issues/3426 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-1417 · Vendor Advisory
• https://github.com/enocknt/gpac/commit/f96bd57c3ccdcde4335a0be28cd3e8fe296993de · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-1417 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-1417 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-1417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-1417 · Security Note
• https://ubuntu.com/security/CVE-2026-1417 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03620 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-1417 · Vendor Advisory
• https://vuldb.com/?submit.736543 · Note
• https://vuldb.com/?ctiid.342806 · Note
• https://t.me/cveNotify/149825 · Telegram Post