{"id":"CVE-2026-124031","kind":"vulnerability","aliases":["CVE-2026-124031"],"related":[],"title":"GPAC: crafted XMT file crashes MP4Box through type confusion","description":"GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.","summary":"GPAC through 26.07.0 casts a Shape's appearance node to M_Appearance without checking its type. A crafted XMT file can make MP4Box perform an invalid memory read and crash.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gpac","media-processing","mp4box","package"],"not_affected_if":["no-gpac-installed","trusted-input-only"],"how_to_check":"- Run `MP4Box -version` and compare against the fixed release, if the sources name one.\n- Check whether your pipeline runs MP4Box or GPAC on XMT files from untrusted sources.","fix":null,"status":"open","published_at":"2026-11-06T20:17:21+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:13+00:00","updated_at":"2026-11-06T20:44:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T20:44:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"GPAC: crafted XMT file crashes MP4Box through type confusion","impact":"low","summary":"GPAC through 26.07.0 casts a Shape's appearance node to M_Appearance without checking its type. A crafted XMT file can make MP4Box perform an invalid memory read and crash.","audience":"developers","category":"package","nicknames":[],"who_cares":["gpac","mp4box","media-processing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"crash of MP4Box after processing a crafted file","analyst_note":"Confirm the fixed version and whether the linked patch on github.com covers this CVE; check the vulncheck advisory for details.","how_to_check":"- Run `MP4Box -version` and compare against the fixed release, if the sources name one.\n- Check whether your pipeline runs MP4Box or GPAC on XMT files from untrusted sources.","plain_action":"","needs_analyst":true,"not_affected_if":["no-gpac-installed","trusted-input-only"],"who_is_affected":"Teams that run GPAC tools such as MP4Box to process XMT or other scene files, especially from untrusted sources, are exposed. Systems that only process trusted media, or do not run GPAC, can skip it. The sources do not give a fixed version range beyond 'through 26.07.0'.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000692,"input_tokens":4308,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124031':12A,15A '-2026':11A,14A '26.07.0':24B,54C '2d':64C 'anoth':91C 'appear':29B,33B,73C,77C,99C 'aspect':63C 'attack':83C 'cast':25B,69C 'check':35B,79C 'condit':96C 'confus':9A,58C 'contain':55C 'craft':2A,39B,87C 'crash':5A,51B,108C 'cve':10A,13A 'drawabl':61C 'field':100C 'file':4A,41B,89C 'get':62C 'gpac':1A,16B,22B,52C 'invalid':47B,104C 'm':32B,76C 'make':43B 'media':18B 'media-process':17B 'memori':48B,105C 'mp4box':6A,20B,44B,109C 'mpeg4':65C 'node':30B,74C,81C,92C 'packag':21B 'perform':45B 'place':90C 'process':19B 'read':49B,106C 'shape':27B,71C 'suppli':85C 'tag':82C 'traverseshap':67C 'trigger':102C 'type':8A,37B,57C,93C 'vulner':59C 'without':34B,78C 'xmt':3A,40B,88C","nicknames":[],"mitigations":[],"who_affected":"Teams that run GPAC tools such as MP4Box to process XMT or other scene files, especially from untrusted sources, are exposed. Systems that only process trusted media, or do not run GPAC, can skip it. The sources do not give a fixed version range beyond 'through 26.07.0'.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gpac","mediaprocessing","medium","mp4box","package"],"campaign_type":null,"search_a":"'-124031':12A,15A '-2026':11A,14A 'confus':9A 'craft':2A 'crash':5A 'cve':10A,13A 'file':4A 'gpac':1A 'mp4box':6A 'type':8A 'xmt':3A","search_b":"'26.07.0':24B 'appear':29B,33B 'cast':25B 'check':35B 'craft':39B 'crash':51B 'file':41B 'gpac':16B,22B 'invalid':47B 'm':32B 'make':43B 'media':18B 'media-process':17B 'memori':48B 'mp4box':20B,44B 'node':30B 'packag':21B 'perform':45B 'process':19B 'read':49B 'shape':27B 'type':37B 'without':34B 'xmt':40B","search_c":"'26.07.0':54C '2d':64C 'anoth':91C 'appear':73C,77C,99C 'aspect':63C 'attack':83C 'cast':69C 'check':79C 'condit':96C 'confus':58C 'contain':55C 'craft':87C 'crash':108C 'drawabl':61C 'field':100C 'file':89C 'get':62C 'gpac':52C 'invalid':104C 'm':76C 'memori':105C 'mp4box':109C 'mpeg4':65C 'node':74C,81C,92C 'place':90C 'read':106C 'shape':71C 'suppli':85C 'tag':82C 'traverseshap':67C 'trigger':102C 'type':57C,93C 'vulner':59C 'without':78C 'xmt':88C","first_public_at":"2026-11-06T20:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124031","severity":null,"published_at":"2026-11-06T20:17:21+00:00","modified_at":"2026-11-06T20:17:21+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null}],"documents":[{"id":89785,"url":"https://github.com/gpac/gpac/commit/43a8329a90ae2907716b593cc3746458516c7c39","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":89786,"url":"https://www.vulncheck.com/advisories/gpac-through-26.07.0-type-confusion-via-drawable-get-aspect-2d-mpeg4","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}