CVE-2026-9572
3.3 LOWA security vulnerability has been detected in GPAC up to 2.4.0
Published: 2026-05-26 · Last updated: 2026-05-28
Severity and scoring
- CVSS
- 3.3 LOW
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- CWE
- CWE-401, CWE-404
Affected products
| Vendor | Product |
|---|---|
| gpac | gpac |
Description
A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-9572
- [Other]https://github.com/gpac/gpac/
- [Patch]https://github.com/gpac/gpac/commit/e79c5cbe8b3fed27f4854ec229457d30c96206f1
- [Exploit reference]https://github.com/gpac/gpac/issues/3557
- [Exploit reference]https://github.com/user-attachments/files/27270415/poc.zip
- [Other]https://vuldb.com/submit/817137
- [Other]https://vuldb.com/vuln/365631
- [Other]https://vuldb.com/vuln/365631/cti
- [Exploit reference]https://github.com/gpac/gpac/issues/3557
- [Other]https://vuldb.com/submit/817137
Related CVEs
Same vendor
- CVE-2026-39103 — Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of ser... (5.5 MEDIUM)
Same CWE
- CVE-2026-53464 — ImageMagick is free and open-source software used for editing and manipulating digital images (4.0 MEDIUM)
- CVE-2026-47213 — Boxlite is a sandbox service that allows users to create lightweight virtual machines (Boxes) and launch OCI containers within them to ru... (6.5 MEDIUM)
- CVE-2026-46679 — libp2p is a JavaScript Implementation of libp2p networking stack (7.5 HIGH)
- CVE-2026-11312 — A vulnerability was found in bytedance InfiniStore up to 0.2.33 (3.3 LOW)
- CVE-2026-10802 — A vulnerability was detected in keystonejs keystone up to 20260319 (4.3 MEDIUM)