CVE-2026-124031 · Package
NO FIX YET
GPAC through 26.07.0 casts a Shape's appearance node to M_Appearance without checking its type. A crafted XMT file can make MP4Box perform an invalid memory read and crash.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run GPAC tools such as MP4Box to process XMT or other scene files, especially from untrusted sources, are exposed. Systems that only process trusted media, or do not run GPAC, can skip it. The sources do not give a fixed version range beyond 'through 26.07.0'.
Not affected if no-gpac-installed, trusted-input-only
Who cares gpac, media-processing, mp4box
MP4Box -version and compare against the fixed release, if the sources name one.No fix yet, per the sources.
GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.