GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4
- Exploited
- No known exploitation
- Fix
- Fix or patch referenced
- Who is exposed
- Not reported
Do first: Apply the patch listed under Evidence.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 7/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
GPAC software (versions through 26.07.0), specifically its MP4Box tool, has a type confusion flaw in how it handles shape appearance nodes. A local attacker with no login needed can crash MP4Box by tricking a user into opening a crafted XMT file, which requires that user action.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure?/25Unknown. No advisory context yet
- Reach?/20Unknown. No tracked technology or package matched
- Severity6.8/10CVSS 6.8
- No patch0/5No signal
What would change the score
- Would score about 62 if added to CISA KEV
- Would score about 57 if CISA's SSVC rates exploitation active
- Would score about 29 if advisories confirm default setups are exposed
What to do
Apply the patch listed under Evidence.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- gpac gpac
through 26.07.0
Evidence 6
- Patch
- Exploit
- Report
- Repository
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-124031
Is CVE-2026-124031 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-124031?
gpac: through 26.07.0.Source: cve.now feed data