MEDIUMCVSS 5.5
GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in src/media_tools/dash_client.c that allows attackers to crash applications via crafted DASH manifests. Attackers can supply an MPD whose AudioChannelConfiguration element omits schemeIdUri or value, crashing MP4Box or GPAC DASH clients and causing denial of service.
Published 2026-11-15 · last modified 2026-11-15
| Vendor | Product |
|---|---|
| gpac | gpac |
Ncerio by BeyondNets · data from NVD, CISA KEV, EPSS.