CVE-2026-9572
LowCVSS 3.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In GPAC up to version 2.4.0, the function Media_GetSample in file src/isomedia/media.c of the MP4Box component causes a memory leak when manipulating the 'cat' argument. The attack requires local access, and the exploit has been publicly disclosed.
Risk Assessment
The risk is exhaustion of system memory by repeatedly calling the vulnerable function, which could lead to denial of service (DoS) in a local environment.
Recommendation
It is recommended to apply the patch with ID e79c5cbe8b3fed27f4854ec229457d30c96206f1 or update GPAC to a version later than 2.4.0.
Original NVD description (English source)
A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.