Type Confusion Vulnerability in GPAC by GPAC Developers
CVE-2026-124030

6.8MEDIUM

Key Information:

Vendor

Gpac

Status
Gpac
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124030?

GPAC prior to version 26.07.0 is susceptible to a type confusion vulnerability in the gf_sg_command_apply() function within src/scenegraph/commands.c. This vulnerability occurs due to failure in verifying that BIFS field-replace command types correspond adequately with target node fields. When an attacker supplies a specially crafted XMT file through MP4Box—potentially during chapter imports—they may exploit this flaw to cause gf_sg_vrml_field_clone() to attempt to copy memory from invalid pointers, ultimately leading to application crashes.

Affected Version(s)

gpac 0 <= 26.07.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124030 - Proof of Concept

References

https://github.com/gpac/gpac/issues/4032
issue-tracking
https://github.com/gpac/gpac
product
https://github.com/gpac/gpac/commit/1359c4da9329cedceeb8f...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexander A. Shvedov (sigdevel)
.