CVE-2026-9572 Details
Description
A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.
A memory leak vulnerability has been identified in GPAC versions through 2.4.0, specifically within the MP4Box component. The issue arises in the 'Media_GetSample' function of 'src/isomedia/media.c', where improper handling of the 'cat' argument leads to a memory leak. This vulnerability can only be exploited in a local environment. The problem occurs when MP4Box concatenates tracks from a malformed MP4 file, causing a sample buffer to be allocated but not properly released. The vulnerability has been publicly disclosed and exploited.
Users are advised to update to the latest version of GPAC, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gpac/gpac/issues/3557 | CISA-ADP | ExploitIssue Tracking |
| https://vuldb.com/submit/817137 | CISA-ADP | Third Party AdvisoryVDB Entry |
| https://github.com/gpac/gpac/ | [email protected] | Product |
| https://github.com/gpac/gpac/commit/e79c5cbe8b3fed27f4854ec229457d30c96206f1 | [email protected] | Patch |
| https://github.com/gpac/gpac/issues/3557 | [email protected] | ExploitIssue Tracking |
| https://github.com/user-attachments/files/27270415/poc.zip | [email protected] | Exploit |
| https://vuldb.com/submit/817137 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/365631 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/365631/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gpac gpac | <= 2.4.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | New CVE Received | [email protected] |