PT-2026-43373 · Undefined · Undefined

Fczhang · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-9567

Mitre

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isom intern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.

Exploit

Fix

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

CVE-2026-9567

Affected Products

Undefined

References · 8

• 🔥❌ https://github.com/user-attachments/files/27196918/poc.zip · Exploit, Deleted
• https://github.com/makesoftwaresafe/gpac/commit/525bf1af642c30af04e4df5345e6d798c0a4d8a1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-9567 · Security Note
• https://github.com/gpac/gpac/issues/3549 · Note
• https://github.com/gpac/gpac · Note
• https://vuldb.com/vuln/365629 · Note
• https://vuldb.com/vuln/365629/cti · Note
• https://vuldb.com/submit/816075 · Note