CVE-2026-50810: GPAC NULL Pointer Dereference in Media Playlist Parser

Technical summary

CVE-2026-50810 is a NULL pointer dereference vulnerability in the GPAC multimedia framework, specifically in the smooth_parse_stream_index() function located in src/media_tools/mpd.c. The flaw exists in the master development branch prior to commit b35c61f104b85fbb16520ac2838d5d2ef70845b5. When the parser processes a malformed or specially crafted Media Presentation Description (MPD) file, it fails to validate a pointer before dereferencing it, leading to a null pointer exception. This results in abnormal process termination classified as CWE-476 (NULL Pointer Dereference).

Business impact

For organizations deploying GPAC-based media streaming solutions, this vulnerability introduces availability risk. If end users or downstream systems process untrusted MPD manifests—such as from third-party streaming sources or potentially compromised content delivery networks—a crash could disrupt service. The impact is limited to availability; no data theft or system compromise is possible. However, in production environments relying on GPAC for continuous media ingest or transcoding pipelines, repeated crashes could degrade service quality and increase operational overhead.

Affected systems

GPAC in its master development branch prior to commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 is affected. The vulnerability exists in the stream indexing parser used for Smooth Streaming media manifests. Stable release versions are not explicitly listed in the available source data; organizations should verify their GPAC version against the vendor's commit history and advisory to determine exposure.

Exploitability

This vulnerability requires local access and user interaction. An attacker must distribute a malicious MPD file and trick a user into opening it with a vulnerable GPAC instance. The attack surface is limited compared to network-based flaws: there is no remote code execution, privilege escalation, or authentication bypass. The barrier to exploitation is moderate—crafting a malformed MPD is technically straightforward, but delivery and social engineering are necessary. The CVSS score of 5.5 (MEDIUM) reflects this: high impact on availability but restricted attack vector and user interaction requirement.

Remediation

Apply the patch from commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 or later in the GPAC repository. This commit addresses the NULL pointer dereference by adding proper validation in the smooth_parse_stream_index() function. Verify the exact version number or release containing this fix against the official GPAC changelog, as the CVE references a development branch rather than a numbered release. Until patched, organizations should enforce controls that restrict users from opening MPD files from untrusted sources.

Patch guidance

Retrieve the latest GPAC source code from the official repository and merge commit b35c61f104b85fbb16520ac2838d5d2ef70845b5 or pull from a version released after this fix was integrated. If your deployment uses a packaged distribution (e.g., via apt, yum, or Docker), check for a patched release version and upgrade accordingly. Test the patched version in a staging environment with known-problematic MPD files to confirm the crash is eliminated. For development environments relying on master HEAD, fast-forward to the fixed commit and rebuild.

Detection guidance

Monitor GPAC process crashes, especially those triggered by media file ingestion. Look for abnormal exits correlated with MPD file parsing. Application logs should show error details around the smooth_parse_stream_index() function. Implement network-level inspection if untrusted MPD manifests are fetched from external sources, and consider blocking or validating suspicious manifest structures. Host-based detection can flag repeated crashes of the GPAC process linked to specific file patterns or sources.

Why prioritize this

Although the CVSS severity is MEDIUM, prioritization depends on your deployment. If GPAC processes media from untrusted external sources (e.g., user uploads, third-party content feeds), elevate priority because malicious files could be readily weaponized. If GPAC is used only with internally controlled, validated content, risk is lower. The lack of KEV status and the development-branch context suggest this is not yet widely exploited, but the fix is straightforward and should be applied in the next maintenance cycle.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) is justified by: high availability impact (A:H) from a guaranteed crash, but limited by local attack vector (AV:L), requirement for user interaction (UI:R), and no scope change or confidentiality/integrity loss. The score accurately reflects a denial-of-service that requires file delivery and user action, rather than a silent remote exploit.

Frequently asked questions