CVE-2026-1415: 
NixOS vulnerability analysis and mitigation

CVE-2026-1415 is a NULL pointer dereference vulnerability in GPAC up to version 2.4.0, affecting the gf_media_export_webvtt_metadata() function in src/media_tools/media_export.c. The flaw was reported on January 11, 2026, by researcher Keryero via a GitHub issue, and was publicly disclosed on January 26, 2026. It affects all GPAC versions through 2.4.0, including versions 2.0, 2.1, 2.2, 2.3, and 2.4.0. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat CVE, GPAC Issue #3428).

The root cause is a NULL pointer dereference (CWE-476) combined with improper resource handling (CWE-404) in gf_media_export_webvtt_metadata(). When GPAC processes an MP4 file whose track handler box (hdlr) contains no name field, the gf_isom_get_handler_name() function returns a NULL nameUTF8 pointer, which is then passed directly to gf_fprintf() with a %s format specifier without a NULL check. On Linux/glibc systems, this results in printing (null) — incorrect but non-crashing behavior — while on Windows and other platforms it causes an application crash. The attack requires a locally accessible, specially crafted MP4 file and user interaction to trigger the vulnerable code path via MP4Box -webvtt-raw. A Python-based PoC generator that creates a malformed MP4 with an empty hdlr name field was published alongside the issue report (GPAC Issue #3428, Patch Commit).

Successful exploitation results in a denial of service through application crash or undefined behavior when processing a malicious MP4 file. There is no impact on confidentiality or integrity — only availability is affected, and only at the local application level. The vulnerability does not enable remote code execution, privilege escalation, or lateral movement, making its overall risk limited to scenarios where GPAC is used to process untrusted media files (GPAC Issue #3428, Red Hat CVE).

A Python-based proof-of-concept exploit is publicly available via the GitHub issue report, generating a crafted MP4 file that triggers the vulnerability. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 296607 has been released to detect this vulnerability (GPAC Issue #3428, Tenable Nessus).

1. Craft malicious MP4: Use the published Python PoC script to generate a crafted MP4 file (poc_null_handler.mp4) containing a track whose hdlr box has no name field, leaving nameUTF8 as NULL.
2. Deliver the file: Place the crafted MP4 on a system where GPAC is installed, or social-engineer a local user into obtaining the file.
3. Trigger the vulnerable code path: Execute MP4Box -webvtt-raw 1 poc_null_handler.mp4 on the target system, which invokes gf_media_export_webvtt_metadata() and passes the NULL handler pointer to gf_fprintf().
4. Observe impact: On Windows/non-glibc platforms, the application crashes (denial of service). On Linux/glibc, the output VTT file contains label: (null), confirming the NULL dereference (GPAC Issue #3428).

• File System: Presence of a crafted MP4 file with an hdlr box containing no name field; unexpected .vtt output files containing label: (null) in the label field.
• Process: Unexpected crash or abnormal termination of MP4Box or any GPAC-based process when processing MP4 files.
• Logs: Application crash logs or core dumps associated with gf_media_export_webvtt_metadata() in src/media_tools/media_export.c around line 536; error output referencing NULL pointer or segmentation fault from GPAC processes.

Apply the patch identified by commit af951b892dfbaaa38336ba2eba6d6a42c25810fd, which adds a NULL check for the handler pointer before passing it to gf_fprintf(). Users should update GPAC to a version incorporating this fix (post-2.4.0 builds from the master branch or any future release). As a workaround, restrict local access to GPAC installations to trusted users only, and avoid processing untrusted or externally sourced MP4 files with MP4Box -webvtt-raw until patched (Patch Commit, Red Hat CVE).

Red Hat has tracked this vulnerability and published an advisory page. The issue was reported responsibly via the GPAC GitHub repository and received a prompt patch from the GPAC development team. No significant broader media coverage or notable researcher commentary beyond the original issue report has been identified.