CVE-2026-124031

MEDIUM 5.5

GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.

CWE	CWE-843
Vendor	gpac
Product	gpac
Published	Nov 6, 2026

Stay Ahead of the Next One

Get instant alerts for gpac gpac

Be the first to know when new medium vulnerabilities affecting gpac gpac are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

gpac / gpac

0 ≤ 26.07.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/gpac/gpac/issues/4030 github.com: https://github.com/gpac/gpac github.com: https://github.com/gpac/gpac/commit/43a8329a90ae2907716b593cc3746458516c7c39 github.com: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/222/222_gf_node_get_tag_compositor_texturing_c_370.xmt github.com: https://github.com/gpac/gpac/blob/v26.07.0/src/compositor/drawable.c#L564-L565 vulncheck.com: https://www.vulncheck.com/advisories/gpac-through-26.07.0-type-confusion-via-drawable-get-aspect-2d-mpeg4

Credits

Alexander A. Shvedov (sigdevel)