CVE-2026-128240
Deferred Deferred - Pending Action

Use-After-Free in GPAC MP4Box via XMT/BT Scene Commands

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128240
EUVD
EUVD-2026-125052

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gpac gpac From 0 (inc) to 26.7.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

GPAC through 26.07.0 has a use-after-free vulnerability in gf_sg_proto_del() where gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can exploit this by providing a crafted XMT/BT scene with prototypes declared via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.

Impact Analysis

This vulnerability could allow attackers to crash the GPAC application, potentially leading to denial-of-service conditions. If exploited, it may cause unexpected behavior or system instability on affected systems running vulnerable versions of GPAC.

Mitigation Strategies

Update GPAC to the latest version beyond 26.07.0 to address the use-after-free vulnerability in gf_sg_proto_del(). Avoid processing untrusted XMT/BT scene files with MP4Box -chap until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...