EUVD-2026-125052

GPAC through 26.07.0 contains a use-after-free vulnerability in gfsgprotodel in src/scenegraph/vrmlproto.c because gfsgreset frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, ...

CVE-2026-128240

GPAC versions through 26.07.0 are vulnerable to a use-after-free vulnerability in the gf_sg_proto_del() function located in src/scenegraph/vrml_proto.c. The root cause is that gf_sg_reset() frees unregistered prototypes that are still referenced by scene commands. An attacker can provide a crafte...