PT-2026-138410
CVE-2026-124031
·
Published
2026-11-06
·
Updated
2026-11-06
Description by
CVSS 3.1
5.5
MediumMetricsAV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GPAC through 26.07.0 contains a type confusion vulnerability in drawable get aspect 2d mpeg4() and TraverseShape() that casts a Shape's appearance node to M Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾