PT-2026-138409
CVE-2026-124030
·
Published
2026-11-06
·
Updated
2026-11-06
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GPAC through 26.07.0 contains a type confusion vulnerability in gf sg command apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf sg vrml field clone() to memcpy from invalid pointers and crash.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾