CVE-2026-14790: NULL Pointer Dereference in GPAC
A null pointer dereference vulnerability exists in GPAC version 26.02.0 within the nhmldump_send_frame function of the Media File Handler component. This flaw requires local access to exploit and can cause a denial of service by crashing the application. The project considers this issue more of a bug than a critical vulnerability. A patch identified by commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 addresses the problem and should be applied.
AI Analysis
Technical Summary
CVE-2026-14790 is a vulnerability in GPAC 26.02.0 affecting the nhmldump_send_frame function in src/filters/write_nhml.c. The flaw allows a local attacker to trigger a null pointer dereference, potentially causing the application to crash. Although the exploit requires local access and no remote exploitation vector is present, the issue has been publicly disclosed and a patch is available. The GPAC project classifies this issue primarily as a bug but recommends fixing it.
Potential Impact
Successful exploitation results in a null pointer dereference leading to application crash or denial of service. The attack requires local access and does not involve privilege escalation or remote code execution. The CVSS 4.8 score reflects a medium severity impact focused on availability disruption.
Mitigation Recommendations
A patch identified by commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 has been released to fix this vulnerability. Users of GPAC 26.02.0 should apply this patch promptly to remediate the issue. Since the vulnerability requires local access, limiting local user permissions can also reduce risk.
CVE-2026-14790: NULL Pointer Dereference in GPAC
Description
A null pointer dereference vulnerability exists in GPAC version 26.02.0 within the nhmldump_send_frame function of the Media File Handler component. This flaw requires local access to exploit and can cause a denial of service by crashing the application. The project considers this issue more of a bug than a critical vulnerability. A patch identified by commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 addresses the problem and should be applied.
CVSS v4.0
Score 4.8medium
Affected software
cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14790 is a vulnerability in GPAC 26.02.0 affecting the nhmldump_send_frame function in src/filters/write_nhml.c. The flaw allows a local attacker to trigger a null pointer dereference, potentially causing the application to crash. Although the exploit requires local access and no remote exploitation vector is present, the issue has been publicly disclosed and a patch is available. The GPAC project classifies this issue primarily as a bug but recommends fixing it.
Potential Impact
Successful exploitation results in a null pointer dereference leading to application crash or denial of service. The attack requires local access and does not involve privilege escalation or remote code execution. The CVSS 4.8 score reflects a medium severity impact focused on availability disruption.
Mitigation Recommendations
A patch identified by commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 has been released to fix this vulnerability. Users of GPAC 26.02.0 should apply this patch promptly to remediate the issue. Since the vulnerability requires local access, limiting local user permissions can also reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-07-05T16:07:15.466Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a4b185b27e9c797198313e9
Added to database: 07/06/2026, 02:52:11 UTC
Last enriched: 07/06/2026, 03:06:32 UTC
Last updated: 07/06/2026, 03:24:16 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.