CVE-2026-124030— GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

Quick assessment

Affected

gpac gpac

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

GPAC 26.07.0 及更早版本存在一个类型混淆漏洞，位于文件中的函数。该漏洞源于未能验证 BIFS 字段替换（field-replace）命令的类型是否与目标节点字段类型相匹配。攻击者可构造特制的 XMT 文件，并通过 MP4Box（例如在章节导入过程中）打开该文件，从而触发函数从无效指针执行操作，导致程序崩溃。

CVSS 5.5 · Medium Updated Nov 07, 2026

Possible ATT&CK Techniques 2 AI

T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
gpac	gpac	`≤ 26.07.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

Source: CVE Program / CVE List V5

Vulnerability Description

GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

使用不兼容类型访问资源(类型混淆)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
gpac	gpac	0 ~ 26.07.0	-

II. Public POCs for CVE-2026-124030

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124030

请登录查看更多情报信息。

Other References for CVE-2026-124030 (6)

https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/224/224_gf_sg_command_apply_scenegraph_commands_c_346.xmt exploit
https://github.com/gpac/gpac product
https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/commands.c#L321 technical-description
https://github.com/gpac/gpac/commit/1359c4da9329cedceeb8fcfeab6d97e0927236e1 patch
https://github.com/gpac/gpac/issues/4032 issue-tracking
https://www.vulncheck.com/advisories/gpac-through-26.07.0-type-confusion-via-gf-sg-command-apply-xmt-field-replace third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-124030

IV. Related Vulnerabilities

Same product: gpac

Same vendor: gpac

Same weakness: CWE-843