CVE-2026-14790: GPAC 26.02.0 Null Pointer Dereference in NHML Handler

Technical summary

CVE-2026-14790 is a null pointer dereference (CWE-476) in GPAC's Media File Handler, specifically in the nhmldump_send_frame function within src/filters/write_nhml.c. The flaw allows a local, authenticated user to craft malicious input that causes the application to dereference a null pointer, resulting in a denial-of-service condition. The vulnerability stems from improper initialization or validation (CWE-404) of pointers before use. Patch bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 resolves the issue by adding appropriate null checks and pointer validation.

Business impact

The primary impact is localized service disruption. A user with system access could crash GPAC's NHML writing function, interrupting media processing workflows. For organizations relying on GPAC for automated media transcoding or metadata generation, this could disrupt batch operations or file ingestion pipelines. However, the attack is limited to local access, does not compromise data confidentiality or integrity, and does not provide privilege escalation—making it a manageable operational concern rather than a critical security incident.

Affected systems

GPAC version 26.02.0 is affected. GPAC is an open-source multimedia framework used for video packaging, streaming, and file handling. The vulnerability impacts any deployment running version 26.02.0 that exposes NHML writing functionality to local users. Organizations using GPAC for media processing pipelines or as a library in multimedia applications should assess whether version 26.02.0 is in use.

Exploitability

Exploitability is limited by the requirement for local system access and valid user credentials. An attacker cannot trigger this vulnerability remotely or without authentication. The fact that a public exploit has been released increases the likelihood of opportunistic local attacks, particularly in multi-user systems or containers where an unprivileged user might attempt to disrupt services. However, the barrier to exploitation remains relatively high compared to remote, unauthenticated vulnerabilities.

Remediation

Apply patch bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 to GPAC to resolve this vulnerability. Verify the patch version against the official GPAC project repository. Organizations should prioritize this update for systems where GPAC is exposed to untrusted local users or where media processing uptime is critical. Where immediate patching is not feasible, restrict NHML writing operations to trusted users and monitor for crashes in GPAC processes.

Patch guidance

Obtain and apply patch bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 from the GPAC project's official source repository. Test the patch in a staging environment before production deployment, particularly if GPAC is integrated into media pipeline infrastructure. Verify that the patched version maintains compatibility with existing configurations and downstream processes. After patching, restart any GPAC services or applications relying on the vulnerable function.

Detection guidance

Monitor GPAC process logs and system logs for crash events or segmentation faults in the nhmldump_send_frame function. If GPAC is deployed in containers or VMs, track unexpected process terminations. Implement application-level logging to capture NHML writing operations and identify patterns of malformed input. Use file integrity monitoring to detect unexpected modifications to GPAC binaries or configuration files that might indicate compromise attempts.

Why prioritize this

Although the CVSS score is low (3.3), this vulnerability warrants timely attention due to the published exploit and its presence in an actively maintained multimedia framework. Prioritize patching in environments where GPAC handles untrusted input or serves multi-user systems. For isolated deployments or single-user media workstations, this can follow standard patch cycles. The lack of remote exploitability and authentication requirements justify a measured rather than emergency response.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW) reflects the combination of local-only access requirements (AV:L), low attack complexity (AC:L), need for user privileges (PR:L), no user interaction required (UI:N), and impact limited to availability (A:L). The score appropriately captures that this is a local denial-of-service condition with limited scope. The published exploit increases real-world risk slightly but does not change the CVSS assessment, which is vulnerability-centric rather than threat-centric.

Frequently asked questions