CVE-2026-95122 in MP4v2
Summary
by MITRE • 10/13/2026
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The mp4v2 library, specifically version 2.0.0, is susceptible to a critical memory safety flaw located within the MP4File class implementation. The vulnerability manifests during the execution of the GenerateTracks method found in the src/mp4file.cpp source file. This function is responsible for processing and organizing track data within an MP4 container structure, a process that involves parsing various metadata atoms and validating structural integrity before generating output or internal representations. In this specific instance, the code fails to adequately verify whether certain pointers are valid prior to their dereference operations. When a crafted input file triggers this code path without providing the expected pointer initialization, the application attempts to access memory at address zero, resulting in an immediate crash of the host process.
From a technical perspective, this flaw is classified as a NULL Pointer Dereference, which corresponds directly to CWE-476 in the Common Weakness Enumeration database. The root cause lies in insufficient input validation and error handling within the parsing logic. Typically, such vulnerabilities arise when developers assume that data structures retrieved from external sources or internal buffers will always contain valid references. In this case, if a malformed MP4 file omits specific track information or contains corrupted atom headers, the pointer variable intended to hold reference to a track object remains null. Subsequent code execution proceeds under the false assumption that the pointer is active, leading to an access violation when the program attempts to read from or write to the memory location pointed to by this null value.
The operational impact of this vulnerability is primarily centered on availability rather than confidentiality or integrity in its current manifestation. A remote attacker can exploit this weakness by distributing a specially crafted MP4 file designed to trigger the specific code path within GenerateTracks(). Upon opening, playing, or processing such a file using any application linked against mp4v2 2.0.0, the process will terminate abruptly due to an unhandled exception. This results in a Denial of Service condition where legitimate users are unable to access media content or utilize applications that rely on this library for video processing tasks. While modern operating systems often isolate such crashes to prevent privilege escalation, repeated exploitation can lead to service instability and resource exhaustion if the application attempts automatic recovery without proper state management.
To mitigate this risk, developers must implement robust input validation mechanisms within the mp4v2 source code. Specifically, every pointer dereference operation should be preceded by a null check to ensure that memory addresses are valid before access is attempted. Additionally, integrating fuzzing techniques during development can help identify edge cases where malformed inputs might bypass existing checks. For end-users and system administrators relying on software built with this library version, the immediate mitigation strategy involves upgrading to a patched version of mp4v2 where these validation gaps have been addressed. Until an update is available, restricting the processing of untrusted MP4 files or implementing sandboxing environments can reduce the attack surface by containing potential crashes within isolated contexts rather than allowing them to disrupt critical services.