CVE-2026-124030

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing...

CVE-2026-124030 GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing...

EUVD-2026-118438

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing...

CVE-2026-124030 GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing...

CVE-2026-124030

GPAC versions through 26.07.0 are vulnerable to a type confusion vulnerability within the gf_sg_command_apply() function in src/scenegraph/commands.c. The root cause is a failure to verify that BIFS field-replace command types match the target node fields. An attacker can provide a crafted XMT fi...

PT-2024-37358 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: GPAC version 2.5-DEV-rev228-g11067ea92-master Description: A problem was found in the function xmt node end of the file src/scene manager/loader xmt.c of the component MP4Box. The issue leads to use after free. Local access is required to...