CVE-2026-1417: Gpac

Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days.

A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: f96bd57c3ccdcde4335a0be28cd3e8fe296993de. Applying a patch is the recommended action to fix this issue.

Affected products

• Gpac Gpac: up to and including 2.4.0

Published 2026-01-26. Last modified 2026-06-17.