CVE-2026-124030: GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

Published Nov 6, 2026

Updated

GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gfsgvrmlfieldclone() to memcpy from invalid pointers and crash.

Event History

Nov 6, 2026

CVE Published

via MITRE·07:14 PM

Data Sourced

via MITRE·07:14 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users or workflows that open attacker-supplied XMT files with MP4Box are exposed. The described delivery path includes importing chapters from a crafted XMT file.

What must an attacker provide to trigger the vulnerability?

An attacker needs to provide a crafted XMT file containing a BIFS field-replace command whose type does not match the target node field. The file must then be opened by MP4Box, including through the chapter-import path.

What is the reported impact?

The type mismatch can cause gf_sg_vrml_field_clone() to copy from invalid pointers, resulting in a crash. The provided information does not establish impacts beyond denial of service.

How can exposure be reduced before an update is applied?

Do not open or import XMT files from untrusted sources with MP4Box, including untrusted chapter-import inputs. Restrict XMT processing to files from trusted, validated sources.

CVE-2026-124030: GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker provide to trigger the vulnerability?

What is the reported impact?

How can exposure be reduced before an update is applied?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker provide to trigger the vulnerability?

What is the reported impact?

How can exposure be reduced before an update is applied?