CVE-2026-1415

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1415
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1415.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1415
Downstream
Published
2026-01-26T02:32:08.374Z
Modified
2026-07-22T03:08:32.892784Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
GPAC media_export.c gf_media_export_webvtt_metadata null pointer dereference
Details

A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gfmediaexportwebvttmetadata of the file src/mediatools/mediaexport.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix this issue, it is recommended to deploy a patch.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1415.json",
    "cwe_ids": [
        "CWE-404",
        "CWE-476"
    ],
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.1"
                },
                {
                    "last_affected": "2.1"
                },
                {
                    "introduced": "2.3"
                },
                {
                    "last_affected": "2.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/enocknt/gpac

Affected ranges

Type
GIT
Repo
https://github.com/enocknt/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
af951b892dfbaaa38336ba2eba6d6a42c25810fd
Database specific 
{
    "source": "REFERENCES"
}
Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
418db4149af78773815b5f6a7030a120037ba140
Last affected
5d70253ac94e5840be7b86054131dd753af63cc7
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.0"
        },
        {
            "last_affected": "2.0"
        },
        {
            "introduced": "2.2"
        },
        {
            "last_affected": "2.2"
        },
        {
            "introduced": "2.4.0"
        },
        {
            "last_affected": "2.4.0"
        },
        {
            "introduced": "0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"
}

Affected versions

2.*
2.0
2.2
2.4.0
v2.*
v2.0.0
v2.2.0
v2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1415.json"
vanir_signatures_modified 
"2026-07-22T03:08:32Z"
vanir_signatures 
[
    {
        "digest": {
            "function_hash": "304413211897014215117190705604506751841",
            "length": 7942.0
        },
        "id": "CVE-2026-1415-62ee540f",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd",
        "signature_type": "Function",
        "target": {
            "function": "gf_media_export_webvtt_metadata",
            "file": "src/media_tools/media_export.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "34795491985642353482004311931802306634",
                "175837824916756214987044212609285221515",
                "331045506257932332180627719451931075664",
                "51773911310296963516386763263776995585",
                "52759737283077204600987176368363802889",
                "110838478313254749812281096982303287083",
                "300613967347047080353260873151976162596",
                "30256998498056139477804360437890967075",
                "243963343580681535721185361089677831531",
                "334034811708045480694307247607344816975",
                "229433760584562919886551649914403232098",
                "162969988608367755388293888433393521493",
                "113285368019917029261129854501689675126",
                "56452623198029851239957758181902895628"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-1415-6e35bf93",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd",
        "signature_type": "Line",
        "target": {
            "file": "src/media_tools/media_export.c"
        }
    }
]