CVE-2026-124030
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. An attacker can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash.
Risk Assessment
The vulnerability can be exploited to cause application crashes (denial of service) when processing malicious media files. The risk affects systems processing untrusted XMT/MP4 files.
Recommendation
Update GPAC to a version containing the fix or restrict processing of untrusted XMT files. Consider running MP4Box in an isolated environment.
Other vulnerabilities in GPAC
See all- CVE-2026-92474Low
A security flaw was discovered in GPAC 26.08-DEV affecting the function gf_inline_get_proto_lib in src/compositor/mpeg4_inline.c (Proto Link Handler component). The manipulation results in a use-after-free condition, and the attack requires local access. The exploit has been publicly released and may be used for attacks.
- CVE-2026-92472Low
A vulnerability was determined in GPAC 26.08-DEV affecting the function gf_node_deactivate_ex in src/scenegraph/base_scenegraph.c (MP4Box component). Executing a manipulation can lead to a use-after-free condition, and the attack requires local access. The exploit has been publicly disclosed and may be utilized.
- CVE-2026-15185Low
A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.
- CVE-2025-70307High
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70308High
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
- CVE-2025-70304High
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
- CVE-2025-70298High
GPAC v2.4.0 was found to contain an out-of-bounds read in the oggdmx_parse_tags function. The issue occurs during processing of OGG data.
- CVE-2021-4043Medium
NULL pointer dereference vulnerability in the GitHub repository gpac/gpac prior to 1.1.0. It may cause an application crash when processing crafted data.
- CVE-2026-124031Medium
GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that cast a Shape's appearance node to M_Appearance without checking its node tag. An attacker can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field, triggering an invalid memory read and crashing MP4Box.
- CVE-2025-60497Medium
A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file.
Original NVD description (English source)
GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS