CVE-2026-128240
MEDIUM
NVD
CVSS Score
5.5
Severity
MEDIUM
Published
Nov 13, 2026
Vendor
unknown
Description
GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.
References
- https://github.com/gpac/gpac
- https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/base_scenegraph.c#L537-L542
- https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/vrml_proto.c#L103-L111
- https://github.com/gpac/gpac/commit/a2e5c62c213b5329a4572fe8e7c333e1ca26d028
- https://github.com/gpac/gpac/issues/4031