CVE-2026-124031
Medium
Description
GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.
SeverityMedium
CVSS5.5
Exploit probability—
ProductGpac
PublishedNov 6, 2026
First seenNov 6, 2026
Weakness typeCWE-843CWE-843
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gpac gpac | v ≤ 26.07.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.