CVE-2026-9572

MediumCVSS 5.5/10Last modified Jul 23, 2026

Description

A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401CWE-404

Affected software

No affected versions have been published.

Timeline

Published
May 26, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-957204.4A buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of serCVE-2026-957213.3A memory corruption vulnerability exists in the web-based management interface of AOS-8. Successful exploitation could allow an authenticateCVE-2026-95737.3A vulnerability was detected in itsourcecode Student Transcript Processing System 1.0. This affects an unknown part of the file /admin/modulCVE-2026-95747.3A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code of the file /admin/mCVE-2026-95757.3A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the fCVE-2026-957546.9In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification bCVE-2026-95764.9The Fluent Booking WordPress plugin before 2.1.2 does not verify ownership of the requested group_id before exporting attendee data via theCVE-2026-95774.8The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the CVE-2026-95796.3A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit oCVE-2026-95807.3A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/CVE-2026-958055.3A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permCVE-2026-958067.7MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point.  The phar stream wrapper caus