UBUNTU-CVE-2026-124030: Medium severity ubuntu/gpac vulnerability
GPAC through 26.07.0 contains a type confusion vulnerability in gfsgcommandapply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gfsgvrmlfieldclone() to memcpy from invalid pointers and crash.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who open attacker-supplied XMT content with MP4Box are exposed, including when XMT is processed through chapter import. The attack requires local interaction because a user must open or import the crafted file.
What does successful exploitation do?
A crafted BIFS field-replace command can cause GPAC to copy from invalid pointers in gf_sg_vrml_field_clone(). The stated impact is a crash, resulting in denial of service.
Are default MP4Box workflows affected?
The available information identifies XMT file handling by MP4Box, including chapter import, as the affected path. It does not state whether every default MP4Box configuration or workflow processes XMT input.