CVE-2026-128240

GPAC through 26.07.0 contains a use-after-free vulnerability in gfsgprotodel in src/scenegraph/vrmlproto.c because gfsgreset frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, ...

CVE-2026-128239

GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a...

CVE-2026-128239 GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers

GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a...

CVE-2026-128239

GPAC versions through 26.07.0 are vulnerable to a NULL pointer dereference within the MPEG-4 Form spatial-constraint handlers located in src/compositor/mpeg4_form.c. This flaw occurs due to unchecked group lookups when processing a crafted XMT scene where Form constraints reference a non-existent...

EUVD-2026-125053

GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a...

CVE-2026-128239 GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers

GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene whose Form constraints reference a...

CVE-2026-128240 GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown

GPAC through 26.07.0 contains a use-after-free vulnerability in gfsgprotodel in src/scenegraph/vrmlproto.c because gfsgreset frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, ...

EUVD-2026-125052

GPAC through 26.07.0 contains a use-after-free vulnerability in gfsgprotodel in src/scenegraph/vrmlproto.c because gfsgreset frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, ...

CVE-2026-128240 GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown

GPAC through 26.07.0 contains a use-after-free vulnerability in gfsgprotodel in src/scenegraph/vrmlproto.c because gfsgreset frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, ...

CVE-2026-128240

GPAC versions through 26.07.0 are vulnerable to a use-after-free vulnerability in the gf_sg_proto_del() function located in src/scenegraph/vrml_proto.c. The root cause is that gf_sg_reset() frees unregistered prototypes that are still referenced by scene commands. An attacker can provide a crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-124031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4 and TraverseShape that casts a Shape's appearance node to MAppearance...

Linux Distros Unpatched Vulnerability : CVE-2026-124030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply in src/scenegraph/commands.c that fails to verify BIFS field-replace command...

CVE-2026-124031

GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4 and TraverseShape that casts a Shape's appearance node to MAppearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance...

CVE-2026-124030

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing...

CVE-2026-124030

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing...

CVE-2026-124031

GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4 and TraverseShape that casts a Shape's appearance node to MAppearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance...

CVE-2026-124030

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing...

CVE-2026-124031

GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4 and TraverseShape that casts a Shape's appearance node to MAppearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance...

EUVD-2026-118439

GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4 and TraverseShape that casts a Shape's appearance node to MAppearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance...

CVE-2026-124031 GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4

GPAC through 26.07.0 contains a type confusion vulnerability in drawablegetaspect2dmpeg4 and TraverseShape that casts a Shape's appearance node to MAppearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance...