Type Confusion Vulnerability in GPAC Product by GPAC
CVE-2026-124031

6.8MEDIUM

Key Information:

Vendor

Gpac

Status
Gpac
Vendor
CVE Published:
6 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-124031?

The vulnerability present in GPAC versions up to 26.07.0 arises from a type confusion issue in the drawable_get_aspect_2d_mpeg4() and TraverseShape() functions. This flaw occurs when the code casts a Shape's appearance node to M_Appearance without validating its node tag. Attackers can exploit this vulnerability by supplying a maliciously crafted XMT file that introduces a non-conforming node type, such as Conditional, into the appearance field. This manipulation can lead to invalid memory reads and cause the MP4Box application to crash.

Affected Version(s)

gpac 0 <= 26.07.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-124031 - Proof of Concept

References

https://github.com/gpac/gpac/issues/4030
issue-tracking
https://github.com/gpac/gpac
product
https://github.com/gpac/gpac/commit/43a8329a90ae2907716b5...
patch

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexander A. Shvedov (sigdevel)
.