CVE-2026-9567

LowCVSS 3.3/10Last modified Jul 23, 2026

Description

A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isom_intern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.

Metrics

CVSS 3.1 3.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404 CWE-476

Affected software

No affected versions have been published.

Timeline

Published: May 26, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-956707.2The No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versi CVE-2026-956715.3In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the H CVE-2026-956745.3In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules t CVE-2026-956759.8D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attacke CVE-2026-956767.5A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote CVE-2026-956796.9MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains CVE-2026-95685.0A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of t CVE-2026-956808.0IBM WebSphere Application Server 8.5, and 9.0 could allow an authenticated attacker to bypass authorization leading to administrative impers CVE-2026-956824.8MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name settin CVE-2026-956835.3In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched t CVE-2026-956847.2The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Paramete CVE-2026-956855.3MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of s