A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix this issue, it is recommended to deploy a patch.
References
| Link | Resource |
|---|---|
| https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd | Patch |
| https://github.com/gpac/gpac/issues/3428 | Exploit Issue Tracking Vendor Advisory |
| https://github.com/gpac/gpac/issues/3428#issue-3802223345 | Exploit Issue Tracking Vendor Advisory |
| https://vuldb.com/?ctiid.342804 | Permissions Required VDB Entry |
| https://vuldb.com/?id.342804 | Third Party Advisory VDB Entry |
| https://vuldb.com/?submit.736541 | Third Party Advisory VDB Entry |
Configurations
History
28 Jan 2026, 15:29
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/enocknt/gpac/commit/af951b892dfbaaa38336ba2eba6d6a42c25810fd - Patch | |
| References | () https://github.com/gpac/gpac/issues/3428 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://github.com/gpac/gpac/issues/3428#issue-3802223345 - Exploit, Issue Tracking, Vendor Advisory | |
| References | () https://vuldb.com/?ctiid.342804 - Permissions Required, VDB Entry | |
| References | () https://vuldb.com/?id.342804 - Third Party Advisory, VDB Entry | |
| References | () https://vuldb.com/?submit.736541 - Third Party Advisory, VDB Entry | |
| First Time |
Gpac
Gpac gpac |
|
| CPE | cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:* |
26 Jan 2026, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-01-26 03:15
Updated : 2026-01-28 15:29
NVD link : CVE-2026-1415
Mitre link : CVE-2026-1415
CVE.ORG link : CVE-2026-1415
JSON object : View
Products Affected
gpac
- gpac