CVE-2026-124031

Description

GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

References

• https://github.com/gpac/gpac/issues/4030 ↗
• https://github.com/gpac/gpac ↗
• https://github.com/gpac/gpac/commit/43a8329a90ae2907716b593cc3746458516c7c39 ↗
• https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/222/222_gf_node_get_tag_compositor_texturing_c_370.xmt ↗
• https://github.com/gpac/gpac/blob/v26.07.0/src/compositor/drawable.c#L564-L565 ↗
• https://www.vulncheck.com/advisories/gpac-through-26.07.0-type-confusion-via-drawable-get-aspect-2d-mpeg4 ↗