Read the docs
TI-2026-86091 Aliases CVE-2026-124031GHSA-f589-88mc-5jx5

Type confusion in GPAC MP4Box crashes via crafted XMT file

Priority LOW 29CWE-843Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-843 and the CVSS impact.

Summary

GPAC through 26.07.0 contains a type confusion flaw in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag (CWE-843). An attacker who supplies a crafted XMT file that places another node type, such as Conditional, in the appearance field can trigger an invalid memory read and crash MP4Box. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node type, such as Conditional, in the appearance field to trigger an invalid memory read and crash MP4Box.

Why it matters now

EPSS 0.00121 1st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
gpacgpacup to 26.07.0—No fix listedCNA
  • gpac Vendorgpac Affected up to 26.07.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for gpac.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-124031
  2. 2026-11-06 Alias added: GHSA-f589-88mc-5jx5
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Exploit 1

Patch 1

Other 3

  • TI-2023-25004 An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote… CVSS 3.1CRITICAL 9.8
  • TI-2025-43085 GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function. CVSS 3.1HIGH 8.2
  • TI-2024-00295 Stack-based Buffer Overflow in gpac/gpac CVSS 3.1CRITICAL 9.8
  • TI-2023-25341 Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master… CVSS 3.1CRITICAL 9.8
  • TI-2023-02661 NULL Pointer Dereference in gpac/gpac CVSS 3.1CRITICAL 9.8
  • TI-2026-22173 GPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflow CVSS 4.0HIGH 7.7
See all 406 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences