CVE-2026-14790: GPAC Privilege Escalation Vulnerability

CVE-2026-14790 Overview

CVE-2026-14790 is a null pointer dereference vulnerability in GPAC 26.02.0, an open-source multimedia framework used for packaging, streaming, and playing media content. The flaw resides in the nhmldump_send_frame function within src/filters/write_nhml.c, part of the Media File Handler component. An attacker with local access can manipulate input to trigger a null pointer dereference, causing the process to crash. The GPAC project maintainers have characterized the class of issues as bugs suitable for fixing rather than high-impact vulnerabilities. A patch identified by commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 is available in the upstream repository.

Critical Impact
Local attackers can trigger a null pointer dereference in the GPAC nhmldump_send_frame routine, resulting in denial of service against the media processing workflow.

Affected Products

GPAC 26.02.0
GPAC Media File Handler component (src/filters/write_nhml.c)
Applications and pipelines that embed GPAC filters for NHML muxing

Discovery Timeline

2026-07-06 - CVE-2026-14790 published to the National Vulnerability Database (NVD)
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14790

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-404] in the nhmldump_send_frame function of GPAC's NHML writer filter. NHML (NHNT Metadata Language) is an XML-based description format used by GPAC to describe media tracks during muxing and demuxing operations. When the function processes a crafted or malformed input frame, an internal pointer expected to reference a valid frame or context structure remains null and is subsequently dereferenced.

The result is an immediate process termination in the GPAC filter chain. Because exploitation requires local access and low privileges, the practical impact is limited to denial of service against the local media processing workload. There is no evidence of active exploitation, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

The root cause is missing validation of a pointer before it is dereferenced inside nhmldump_send_frame. Related fuzzing-driven fixes in the same patch commit added integer overflow guards and cleaned up input handling in adjacent filters, such as src/filters/mux_gsf.c and src/filters/reframe_amr.c, indicating that the surrounding NHML and muxer code paths lacked defensive checks against malformed frame metadata.

Attack Vector

Exploitation requires local access to a system running a vulnerable version of GPAC. An attacker supplies a crafted media file that is processed by the NHML writer filter, either directly through MP4Box or gpac command-line tools or indirectly through an application that embeds the library. The publication references indicate the exploit has been disclosed publicly through VulDB.

// Security patch excerpt: src/filters/mux_gsf.c
// Adds an integer overflow guard before allocating the output packet
            hdr_size = gsfmx_get_header_size(ctx, gst, use_seq_num, first_frag, no_frag, ctx->mpck - hdr_size, frame_size, block_offset);
            to_write = ctx->mpck - hdr_size;
        }
        if (to_write >= GF_UINT_MAX-hdr_size)
            break;
        osize = hdr_size + to_write;

        dst_pck = gf_filter_pck_new_alloc(ctx->opid, osize, &output);

Source: GitHub Commit bd1d94e

The patch adds a bounds check preventing arithmetic overflow before allocating the destination packet, closing one of the memory safety issues fixed in the same commit series.

Detection Methods for CVE-2026-14790

Indicators of Compromise

Unexpected crashes or segmentation faults from gpac, MP4Box, or applications linking libgpac during NHML muxing operations
Core dump artifacts referencing nhmldump_send_frame or write_nhml.c in the stack trace
Presence of untrusted or externally sourced media files staged in directories processed by automated GPAC pipelines

Detection Strategies

Inventory endpoints and build systems that ship GPAC 26.02.0 and correlate installed versions against the patched commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160
Monitor process telemetry for repeated abnormal terminations of GPAC binaries, which may indicate crash-driven denial of service attempts
Review application logs from media transcoding services for filter chain failures in the NHML writer path

Monitoring Recommendations

Enable core dump collection on media processing hosts and route crash reports to a central location for analysis
Track file system events for media inputs supplied by untrusted local users to systems running GPAC
Alert on repeated exit-code failures from scheduled jobs that invoke MP4Box or gpac filter graphs

How to Mitigate CVE-2026-14790

Immediate Actions Required

Upgrade GPAC to a build that includes commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 or a later release
Restrict which local users can submit media files to GPAC-driven workflows on shared systems
Rebuild any downstream applications that statically link libgpac after applying the patch

Patch Information

The upstream fix is delivered in commit bd1d94e70e3bef364c07c5a1d94eca5c9f56e160 in the GPAC GitHub repository. The commit consolidates multiple fuzz-driven memory fixes, including the null pointer dereference in nhmldump_send_frame. Related discussion is tracked in GPAC Issue 3596, with additional context in the VulDB entry for CVE-2026-14790.

Workarounds

Disable the NHML writer filter in GPAC pipelines that do not require NHML output
Sandbox GPAC processing under a restricted service account to contain crashes and prevent broader impact
Validate media inputs with a separate parser before routing them to GPAC filter chains

bash

# Verify installed GPAC version and confirm the patched commit is present
MP4Box -version 2>&1 | grep -i version
git -C /path/to/gpac log --oneline | grep bd1d94e70e3bef364c07c5a1d94eca5c9f56e160