CVE-2026-128240: GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown
GPAC through 26.07.0 contains a use-after-free vulnerability in gfsgprotodel() in src/scenegraph/vrmlproto.c because gfsgreset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Deployments that use MP4Box with the -chap option to process XMT or BT scene content are exposed when that content can be attacker-controlled. The described impact is a crash of the MP4Box process.
What must an attacker provide to trigger the issue?
An attacker needs to supply a crafted XMT or BT scene that declares prototypes through scene commands. User interaction is required according to the CVSS vector, consistent with someone processing the crafted scene using MP4Box -chap.
How can I determine whether an affected version is in use?
The issue affects GPAC through version 26.07.0. Review the installed GPAC version and identify workflows invoking MP4Box with -chap on XMT or BT scene inputs, particularly inputs obtained from untrusted sources.