CVE-2026-9572

Name	CVE-2026-9572
Description	A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gpac (PTS)	bullseye (security), bullseye	1.0.1+dfsg1-4+deb11u3	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gpac	source	bullseye	(unfixed)	end-of-life
gpac	source	(unstable)	(unfixed)

Notes

[bullseye] - gpac <end-of-life> (EOLed in debian-security-support)
https://github.com/gpac/gpac/issues/3557
https://github.com/gpac/gpac/commit/e79c5cbe8b3fed27f4854ec229457d30c96206f1