Is there a public PoC exploit available for CVE-2026-9572?

Yes, a public proof-of-concept exploit is available for CVE-2026-9572. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-9572?

Yes, a patch is available for CVE-2026-9572. Update the affected software to the latest version immediately.

GPAC MP4Box CVE-2026-9572

Q: What is the CVSS score of CVE-2026-9572?

CVE-2026-9572 has a CVSS 4.0 base score of 1.9 (Low). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31955 LOW

Memory Leak (CWE-401)

2026-05-26 VulDB

GHSA-77xc-cwff-62wp

Information Disclosure Gpac

1.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.9 LOW

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 08, 2026 - 13:38 vuln.today

Analysis Generated

Jun 08, 2026 - 13:38 vuln.today

CVSS changed

May 26, 2026 - 19:22 NVD

3.3 (LOW) 1.9 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.

AnalysisAI

Memory leak in GPAC MP4Box up to version 2.4.0 allows a local, low-privileged attacker to exhaust process memory by supplying a crafted MP4 file that triggers the vulnerable Media_GetSample function in src/isomedia/media.c. The root cause is a missing zero-size guard before memory allocation when the cat argument is manipulated to produce a zero-sum of data_size and padding_bytes. A publicly available proof-of-concept exploit (poc.zip) exists, but the CVSS 4.0 score of 1.9, EPSS of 0.01% (2nd percentile), and strictly local attack vector collectively indicate very low real-world risk; no active exploitation has been identified.

Technical ContextAI

GPAC is an open-source multimedia framework widely used for MP4/ISOBMFF processing; MP4Box is its primary command-line tool for muxing and inspecting ISO Base Media File Format containers. The vulnerable code path is Media_GetSample (src/isomedia/media.c), which retrieves sample data for a given track. The CWE-401 (Missing Release of Memory after Effective Lifetime) root cause manifests when data_size + mdia->mediaTrack->padding_bytes evaluates to zero: prior to the patch, no guard existed before passing this zero value to the custom sample_alloc_cbk, gf_realloc, or gf_malloc allocation paths. The fix (commit e79c5cbe) precomputes size_to_alloc and returns GF_IO_ERR immediately if it is zero, preventing the degenerate allocation. Affected CPE: cpe:2.3:a:n/a:gpac:*:*:*:*:*:*:*:*, covering GPAC 2.0 through 2.4.0 per EUVD-2026-31955.

RemediationAI

The upstream fix is available as commit e79c5cbe8b3fed27f4854ec229457d30c96206f1 on the GPAC GitHub repository (https://github.com/gpac/gpac/commit/e79c5cbe8b3fed27f4854ec229457d30c96206f1). No tagged release version containing this fix has been independently confirmed at time of analysis - organizations should build from the patched commit or monitor the GPAC release page (https://github.com/gpac/gpac/) for an official release that includes it. As a compensating control where patching is not immediately possible, restrict MP4Box execution to trusted input files only, enforced via file-system ACLs or process sandboxing (e.g., seccomp, AppArmor) that limits which users or services can invoke the tool. The availability impact is low, so risk of delaying the patch until the next scheduled maintenance window is acceptable for most deployments.