CVE-2026-95122
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service
Risk Assessment
An attacker can crash an application that processes MP4 files, leading to service unavailability.
Recommendation
Update mp4v2 to a patched version or avoid processing untrusted MP4 files until updated.
Other vulnerabilities in mp4v2
See all- CVE-2026-95121Unknown
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp. A specially crafted MP4 file can cause an undersized rtp atom to produce a near-2^64 allocation size through an unchecked offset subtraction
- CVE-2023-33717Medium
mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch exceptions thrown by ReadBytes().
- CVE-2023-33719Medium
Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4SdpAtom::Read() function in atom_sdp.cpp.
- CVE-2023-33716Medium
Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4StringProperty class in mp4property.cpp.
- CVE-2023-33718High
Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4File::ReadString() function in mp4file_io.cpp.
- CVE-2023-33720Medium
Version 2.1.2 of the mp4v2 library was discovered to contain a memory leak in the MP4BytesProperty class.
Original NVD description (English source)
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service
Vulnerability data from NVD (NIST) · CISA KEV · EPSS