CVE-2026-1417: 
NixOS vulnerability analysis and mitigation

CVE-2026-1417 is a NULL pointer dereference vulnerability in GPAC's dump_isom_rtp() function, located in applications/mp4box/filedump.c. It affects GPAC versions up to and including 2.4.0, and was reported on January 11, 2026, with public disclosure on January 26, 2026. The vulnerability is triggered locally when a user processes a crafted MP4 file containing a hint track without SDP information. It carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat Advisory, GPAC GitHub Issue).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-404 (Improper Resource Shutdown or Release). In dump_isom_rtp(), the function gf_isom_sdp_track_get() initializes the sdp pointer to NULL and may return GF_OK without populating it — for example, when the track lacks a udta box or an hnti->SDP entry. The calling code at line 898 of filedump.c neither checks the return value of gf_isom_sdp_track_get() nor validates whether sdp is NULL before passing it to fprintf() with the %s format specifier. On Linux/glibc systems this results in printing (null) (undefined but non-crashing behavior), while on Windows and other platforms it causes a crash (GPAC GitHub Issue). The attack requires local access and user interaction (opening a malicious MP4 file with MP4Box -drtp).

Successful exploitation results in a limited denial-of-service condition — specifically, an application crash or incorrect output when processing a crafted MP4 file. There is no impact on confidentiality or integrity; only availability is affected, and only at a low level (the MP4Box process crashes or misbehaves). The vulnerability does not enable code execution, privilege escalation, or lateral movement, and its scope is confined to the local user running the affected MP4Box tool (GPAC GitHub Issue, Red Hat Advisory).

A public proof-of-concept Python script is available that generates a crafted poc_null_sdp.mp4 file to trigger the vulnerability, making reproduction straightforward. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of widespread exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is detected by Tenable Nessus plugin 296608 (GPAC GitHub Issue, Tenable).

1. Craft the malicious MP4 file: Use the publicly available Python PoC script to generate poc_null_sdp.mp4 — a minimal MP4 containing a hint track (handler type hint) with an RTP sample entry but deliberately omitting the udta/hnti/SDP boxes, ensuring gf_isom_sdp_track_get() returns GF_OK with sdp remaining NULL.
2. Deliver the file: Provide the crafted MP4 to a target user via any local or social-engineering vector (e.g., shared file system, email attachment, download link).
3. Trigger the vulnerability: Convince the target to run MP4Box -drtp poc_null_sdp.mp4. This invokes dump_isom_rtp(), which calls gf_isom_sdp_track_get() and then passes the NULL sdp pointer directly to fprintf(dump, "%s", sdp).
4. Observe the result: On Linux/glibc, (null) is printed (incorrect output, undefined behavior); on Windows and non-glibc platforms, the application crashes with a NULL pointer dereference (GPAC GitHub Issue).

• File System: Presence of a crafted MP4 file (e.g., poc_null_sdp.mp4) containing a hint track with handler type hint but no udta, hnti, or SDP boxes.
• Process: Unexpected crash or abnormal termination of the MP4Box process when invoked with the -drtp flag.
• Logs: Application output containing the string (null) where SDP track data is expected, indicating a NULL pointer was passed to fprintf(); crash dumps or core files associated with the MP4Box process (GPAC GitHub Issue).

The fix is available via commit f96bd57c3ccdcde4335a0be28cd3e8fe296993de, which adds a NULL and size check (if (sdp && size)) before the fprintf() call in dump_isom_rtp(). Users should apply this patch or update to a version of GPAC that includes it. As a workaround, avoid processing untrusted MP4 files with MP4Box -drtp until the patch is applied (Patch Commit, GPAC GitHub Issue).

Red Hat has acknowledged the vulnerability and published a security advisory tracking it. The issue was reported by researcher "Keryero" on the GPAC GitHub repository on January 11, 2026, with a detailed write-up and PoC. Community reaction has been minimal given the low severity, with automated vulnerability aggregators (VulDB, Vulners, CIRCL) picking up the disclosure shortly after publication (Red Hat Advisory, GPAC GitHub Issue).