CVE-2026-128239

GPAC versions through 26.07.0 are vulnerable to a NULL pointer dereference within the MPEG-4 Form spatial-constraint handlers located in src/compositor/mpeg4_form.c. This flaw occurs due to unchecked group lookups when processing a crafted XMT scene where Form constraints reference a non-existent...