CVE-2026-124030

GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

6.8 Medium

GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.12%Scored on 2026-11-07. The trend appears after a second daily score.

What each source reports

CVE List Score used 6.8

GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

Record: CVE-2026-124030
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-843
Updated: 2026-11-06

EUVDEUVD-2026-118438 6.8

Record: EUVD-2026-118438
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-07

GitHub AdvisoriesGHSA-xx5j-3p7q-h39r 6.8

GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src...

Record: GHSA-xx5j-3p7q-h39r
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-843
Updated: 2026-11-06

NVD 6.8

Record: CVE-2026-124030
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-843
Updated: 2026-11-06

OSV 6.8

GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

Record: CVE-2026-124030
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-843
Updated: 2026-11-08

Affected products

gpac

History

History
Recorded	Changed	Sources
Nov 7, 2026	references	OSV
Nov 7, 2026	published	EUVD
Nov 6, 2026	published	EUVD, NVD
Nov 6, 2026	aliases, references	GitHub Advisories
Nov 6, 2026	cwes, products, references, severity, title	CVE List
Nov 6, 2026	first indexed	EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-124030 is a medium vulnerability (CVSS 6.8) in Gpac, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.12%, the 1st percentile. No source names a fixed version.