CVE-2026-9567: GPAC MP4Box isom_intern.c MergeFragment null pointer dereference
A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isomintern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC MP4Box (src/isomedia/isom_intern.c: MergeFragment)to a version that resolves this vulnerability.Patch 525bf1af642c30af04e4df5345e6d798c0a4d8a1 - Compensating control
Approach the attack locally (limit exposure so the GPAC MP4Box parsing/conversion is only reachable/usable from local trusted contexts, since the attack needs to be approached locally).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9567?
CVE-2026-9567 has a severity rating of low, with a score of 3.3.
How do I fix CVE-2026-9567?
To fix CVE-2026-9567, update your GPAC software to version 2.4.1 or later.
What impact does CVE-2026-9567 have on systems?
CVE-2026-9567 can lead to a null pointer dereference, which may cause the application to crash.
Is CVE-2026-9567 locally exploitable?
Yes, the exploit for CVE-2026-9567 requires local access to the system.
What component of GPAC is affected by CVE-2026-9567?
CVE-2026-9567 affects the MergeFragment function in the src/isomedia/isom_intern.c file of the GPAC MP4Box component.