{"id":"UBUNTU-CVE-2026-95122","details":"mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp. This allows a remote attacker to cause a denial of service","modified":"2026-10-17T13:01:19.384373299Z","published":"2026-10-13T15:17:00Z","upstream":["CVE-2026-95122"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-95122"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-95122"},{"type":"REPORT","url":"https://gist.github.com/1820893135-pixel/607844240f0c965b4dc1f5fdb7ac6148"},{"type":"REPORT","url":"https://github.com/TechSmith/mp4v2/issues/99"},{"type":"REPORT","url":"https://github.com/TechSmith/mp4v2/pull/101"},{"type":"REPORT","url":"https://github.com/TechSmith/mp4v2/pull/101/changes/b5df7f39d741d8926da1ac80fa8c579c30686e7f"}],"affected":[{"package":{"name":"mp4v2","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/mp4v2?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~dfsg0-3","2.0.0~dfsg0-4"],"ecosystem_specific":{"binaries":[{"binary_version":"2.0.0~dfsg0-4","binary_name":"libmp4v2-2"},{"binary_name":"mp4v2-utils","binary_version":"2.0.0~dfsg0-4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-95122.json"}},{"package":{"name":"mp4v2","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/mp4v2?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~dfsg0-6"],"ecosystem_specific":{"binaries":[{"binary_name":"libmp4v2-2","binary_version":"2.0.0~dfsg0-6"},{"binary_name":"mp4v2-utils","binary_version":"2.0.0~dfsg0-6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-95122.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}