Executive brief
A memory leak vulnerability was identified in GPAC, a multimedia framework used for video streaming and transcoding. When the MP4Box utility processes specifically malformed MP4 files, it fails to properly release memory, which could lead to increased resource consumption or application instability. This issue primarily affects local environments where an attacker can provide a malicious file for processing.
Technical details
A memory leak (CWE-401) exists in GPAC up to version 2.4.0 within the Media_GetSample function in src/isomedia/media.c. The vulnerability is triggered when the MP4Box component uses the '-cat' argument to concatenate tracks from a malformed MP4 file containing inconsistent ISOBMFF structures, such as unsupported hint tracks or missing sample tables. During this process, a sample buffer is allocated but not released when certain track types are removed from the destination. An attacker with local access can exploit this by providing a crafted MP4 file, potentially leading to a denial-of-service condition through memory exhaustion. A patch (commit e79c5cb) has been released to address this and prevent related undefined behavior.
Affected products
- GPAC GPAC up to 2.4.0
Timeline
- 2026-05-01: disclosed: Issue reported on GitHub repository
- 2026-05-26: advisory: CVE-2026-9572 published
- 2026-05-26: patched: Patch commit e79c5cbe8b3fed27f4854ec229457d30c96206f1 identified