CVE-2026-1415

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1415
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1415.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-1415
Downstream
Published
2026-01-26T03:15:49.780Z
Modified
2026-03-15T22:21:53.137461Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
Summary
[none]
Details

A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gfmediaexportwebvttmetadata of the file src/mediatools/mediaexport.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix this issue, it is recommended to deploy a patch.

References

Affected packages

Git / github.com/enocknt/gpac

Affected ranges

Type
GIT
Repo
https://github.com/enocknt/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
af951b892dfbaaa38336ba2eba6d6a42c25810fd
Type
GIT
Repo
https://github.com/gpac/gpac
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5d70253ac94e5840be7b86054131dd753af63cc7
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.0"
        }
    ]
}

Affected versions

v0.*
v0.5.2
v0.6.0
v0.6.1
v0.7.0
v0.7.1
v0.8.0
v0.9.0
v0.9.0-preview
v1.*
v1.0.0
v1.0.1
v2.*
v2.0.0
v2.2.0
v2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-1415.json"
vanir_signatures 
[
    {
        "signature_version": "v1",
        "target": {
            "file": "src/media_tools/media_export.c",
            "function": "gf_media_export_webvtt_metadata"
        },
        "source": "https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd",
        "deprecated": false,
        "digest": {
            "function_hash": "304413211897014215117190705604506751841",
            "length": 7942.0
        },
        "id": "CVE-2026-1415-62ee540f",
        "signature_type": "Function"
    },
    {
        "signature_version": "v1",
        "target": {
            "file": "src/media_tools/media_export.c"
        },
        "source": "https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "34795491985642353482004311931802306634",
                "175837824916756214987044212609285221515",
                "331045506257932332180627719451931075664",
                "51773911310296963516386763263776995585",
                "52759737283077204600987176368363802889",
                "110838478313254749812281096982303287083",
                "300613967347047080353260873151976162596",
                "30256998498056139477804360437890967075",
                "243963343580681535721185361089677831531",
                "334034811708045480694307247607344816975",
                "229433760584562919886551649914403232098",
                "162969988608367755388293888433393521493",
                "113285368019917029261129854501689675126",
                "56452623198029851239957758181902895628"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-1415-6e35bf93",
        "signature_type": "Line"
    }
]