gistfile1.txt

# CVE-2026-50810

NULL pointer dereference in GPAC Smooth Streaming manifest conversion (mpd.c) allows denial of service via a crafted Smooth Streaming manifest file.

------------------------------------------

[Vulnerability Type]
NULL Pointer Dereference

------------------------------------------

[Vendor of Product]
GPAC

------------------------------------------

[Affected Product Code Base]
GPAC before commit b35c61f104b85fbb16520ac2838d5d2ef70845b5

Affected versions:
v26.02.0 and earlier pre-fix builds

------------------------------------------

[Affected Component]
src/media_tools/mpd.c
(smooth_parse_stream_index, gf_mpd_init_smooth_from_dom, gf_mpd_smooth_to_mpd)

------------------------------------------

[Attack Vectors]
Convert a crafted Smooth Streaming manifest file with MP4Box -mpd.

The malformed manifest contains StreamIndex c timing entries without a Url attribute, causing smooth_parse_stream_index() to process chunk entries while set->segment_template remains NULL.

------------------------------------------

[Impact]
Denial of Service

------------------------------------------

[Reference]
https://github.com/gpac/gpac/issues/3507
https://github.com/gpac/gpac/commit/b35c61f104b85fbb16520ac2838d5d2ef70845b5

------------------------------------------

[Discoverer]
Junsu Han