GPAC up to 26.07.0 XMT file drawable_get_aspect_2d_mpeg4/TraverseShape appearance type confusion

Summaryinfo

A vulnerability marked as critical has been reported in GPAC up to 26.07.0. Impacted is the function drawable_get_aspect_2d_mpeg4/TraverseShape of the component XMT file Handler. The manipulation of the argument appearance leads to type confusion. This vulnerability is uniquely identified as CVE-2026-124031. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in GPAC up to 26.07.0. It has been rated as critical. This issue affects the function drawable_get_aspect_2d_mpeg4/TraverseShape of the component XMT file Handler. The manipulation of the argument appearance with an unknown input leads to a type confusion vulnerability. Using CWE to declare the problem leads to CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-124031 since 11/06/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/06/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Multimedia Player Software

Name

• GPAC

Version

• 26.07

License

• open-source

Website

• Product: https://github.com/gpac/gpac/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion