CVE-2026-109967
Received Received - Intake

NULL Pointer Dereference in yt-dlp-web-ui

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method that allows remote unauthenticated attackers to crash the server. Attackers can send a single request with a url value like --version, causing invalid yt-dlp JSON output and an unrecovered panic that terminates the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109967
EUVD
EUVD-2026-98693

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
marcopiovanello yt-dlp-web-ui 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

yt-dlp-web-ui through version 4.0.0 has a NULL pointer dereference vulnerability in the Service.Formats JSON-RPC method. Attackers can send a crafted request with a URL like --version, causing invalid yt-dlp JSON output. This triggers an unrecovered panic that crashes the server process.

Detection Guidance

To detect this vulnerability, monitor for crashes in yt-dlp-web-ui processes after receiving JSON-RPC requests with URLs starting with hyphens like --version. Check server logs for panic errors or process termination in the RPC service. Use network traffic analysis to identify unauthenticated requests to /rpc/http or /rpc/ws endpoints.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to crash the yt-dlp-web-ui server by sending a single malicious request. The server downtime could disrupt video downloads, livestream monitoring, and other services relying on the RPC interface.

Mitigation Strategies

Immediately disable or block access to the JSON-RPC endpoints (/rpc/http and /rpc/ws) if possible. Update firewall rules to restrict access to these endpoints. Since the project is archived and no fixes are available, consider migrating to an alternative solution or disabling the service until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109967. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart