CVE-2026-95122: Null Pointer Dereference
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service
Affected Software
Event History
Frequently Asked Questions
What input would an attacker need to trigger this issue?
An attacker would need to provide MP4 content that reaches MP4File::GenerateTracks() in the affected mp4v2 library. The reported impact is a denial of service through a NULL pointer dereference.
Which deployments are exposed?
Deployments using mp4v2 2.0.0 are affected when they process remotely supplied MP4 files or streams. The available information does not identify any specific application integrations or configurations.
What can be done if an update cannot be applied immediately?
Avoid processing untrusted MP4 input with the affected library, or isolate MP4 parsing in a separate process with restricted resources so a crash does not disrupt the primary service.
How can I determine whether my environment is affected?
Check whether your application includes or links against mp4v2 version 2.0.0 and processes MP4 input. Review the referenced issue and pull request for the code changes related to MP4File::GenerateTracks().