GPAC · CVE-2026-128240 · Package
NO FIX YET
GPAC through 26.07.0 frees unregistered prototypes in gf_sg_reset() while scene commands still reference them. A crafted XMT/BT scene file processed by MP4Box -chap can make the process access freed memory and crash.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems that run GPAC's MP4Box tool with -chap on XMT or BT scene files from untrusted sources can be hit. The sources describe a crash rather than code execution. Teams that only process their own media files or do not use GPAC can skip it.
Not affected if gpac-not-installed, no-untrusted-input
Who cares gpac, media-processing, mp4box
MP4Box -version to see the installed GPAC version and compare it with the fixed release.MP4Box -chap on untrusted XMT or BT files.No fix yet, per the sources.
GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.