CVE-2026-14790

LowCVSS 3.3

Published: 06/07/2026(UTC)Updated: 06/07/2026(UTC)Translated: 07/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

Summary

A flaw in GPAC 26.02.0 affects the nhmldump_send_frame function in src/filters/write_nhml.c of the Media File Handler component, leading to a null pointer dereference. The attack requires local access and an exploit has been published.

Risk Assessment

The organization faces a risk of local denial of service (DoS) due to a null pointer dereference in GPAC, potentially disrupting applications that rely on this media processing library.

Recommendation

Apply the patch identified as bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 immediately. Upgrading to the latest version of GPAC is recommended to remediate this vulnerability.

Original NVD description (English source)

A flaw has been found in GPAC 26.02.0. This affects the function nhmldump_send_frame of the file src/filters/write_nhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be used. This patch is called bd1d94e70e3bef364c07c5a1d94eca5c9f56e160. A patch should be applied to remediate this issue. The project explains: "I would consider most of these more as bugs than vulns but anyway they're good to fix".