CVE-2026-1416: 
NixOS vulnerability analysis and mitigation

CVE-2026-1416 is a NULL pointer dereference vulnerability in GPAC up to version 2.4.0, affecting the DumpMovieInfo() function in applications/mp4box/filedump.c. When MP4Box processes a crafted MP4 file containing a chapter track with an empty text sample (text_length = 0), the txt->text pointer remains NULL and is passed directly to fprintf() with the %s format specifier, resulting in undefined behavior. The vulnerability was reported on January 11, 2026, and published on January 26, 2026. It carries a CVSS v3.1 base score of 3.3 (Low) (Feedly, GPAC Issue).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-404 (Improper Resource Shutdown or Release). In gf_isom_parse_text_sample() (in src/isomedia/tx3g.c), the txt->text field is only allocated when the parsed text length (s->len) is greater than zero; when s->len == 0, txt->text remains NULL due to zero-initialization via GF_SAFEALLOC. The calling code in DumpMovieInfo() at line 4189 does not check for a NULL txt->text before passing it to fprintf(), triggering undefined behavior — on Linux/glibc systems this prints (null) non-portably, while on Windows and other platforms it causes a crash. Exploitation requires local access and user interaction (opening a malicious MP4 file with MP4Box -info). A public PoC Python script that generates a triggering MP4 file is available in the issue report (GPAC Issue).

Successful exploitation results in a denial-of-service condition limited to the MP4Box application process — the application crashes or produces incorrect output when processing the malicious file. There is no impact on confidentiality or integrity; only availability is affected, and only at the application level (not the underlying system). The vulnerability cannot be used for remote code execution, privilege escalation, or lateral movement (Feedly, GPAC Issue).

A proof-of-concept Python script that generates a triggering MP4 file is publicly available in the GPAC GitHub issue tracker (GPAC Issue). There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the wild (Feedly).

1. Craft a malicious MP4 file: Use the public PoC Python script from the GPAC issue report to generate poc_null_text.mp4 — a valid MP4 containing a video track with a chap track reference pointing to a text/chapter track whose single text sample has text_length = 0 (encoded as struct.pack('>H', 0)).
2. Deliver the file to the target: Place the crafted MP4 file in a location accessible to the target user (e.g., via email attachment, shared drive, or social engineering).
3. Trigger the vulnerability: Convince the target user to run MP4Box -info poc_null_text.mp4 on a system with a vulnerable GPAC version (≤ 2.4.0). This invokes DumpMovieInfo(), which processes the chapter track and calls gf_isom_parse_text_sample(), returning a GF_TextSample with txt->text == NULL.
4. Observe the result: On Linux/glibc, fprintf() prints (null) for the chapter text — incorrect output confirming the NULL dereference. On Windows or non-glibc platforms, the application crashes, achieving a denial-of-service condition (GPAC Issue).

• File System: Presence of a crafted MP4 file with a chapter track containing a zero-length text sample; suspicious MP4 files received from untrusted sources.
• Process: Unexpected crash or abnormal termination of the MP4Box process; core dump files generated by MP4Box in the working directory.
• Logs: Application error logs showing MP4Box crashes or stderr output containing (null) in chapter track information lines (e.g., #1 - 00:00:00.000 - "(null)") when running MP4Box -info on a file (GPAC Issue).

Apply the patch identified as commit d45c264c20addf0c1cc05124ede33f8ffa800e68, which adds a NULL check before passing txt->text to fprintf(): txt->text ? txt->text : "" (Patch Commit). Users should upgrade to a GPAC version beyond 2.4.0 that includes this fix. As a workaround where upgrading is not immediately possible, restrict local access to systems running vulnerable GPAC versions and avoid processing untrusted MP4 files with MP4Box -info (Feedly).

Red Hat has acknowledged the vulnerability and published a security advisory page for CVE-2026-1416 (Red Hat Advisory). The issue was reported responsibly via the GPAC GitHub issue tracker by researcher "Keryero" on January 11, 2026, with a detailed write-up and PoC (GPAC Issue). No significant broader media coverage or notable social media discussion has been observed, consistent with the low severity rating of the vulnerability.