{"id":"CVE-2026-128240","summary":"GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown","details":"GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prototypes via commands, processed by MP4Box -chap, to trigger freed memory access and crash the process.","modified":"2026-11-15T02:46:35.281042251Z","published":"2026-11-13T09:33:46.903Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-416"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128240.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128240.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128240"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/gpac-through-26.07.0-use-after-free-in-gf-sg-proto-del-during-scene-teardown"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/4031"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/a2e5c62c213b5329a4572fe8e7c333e1ca26d028"},{"type":"PACKAGE","url":"https://github.com/gpac/gpac"},{"type":"ARTICLE","url":"https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/base_scenegraph.c#L537-L542"},{"type":"ARTICLE","url":"https://github.com/gpac/gpac/blob/v26.07.0/src/scenegraph/vrml_proto.c#L103-L111"},{"type":"EVIDENCE","url":"https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/223/223_gf_sg_proto_del_scenegraph_vrml_proto_c.xmt"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"a2e5c62c213b5329a4572fe8e7c333e1ca26d028"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"26.07.0"}]},{"range":[{"fixed":"a2e5c62c213b5329a4572fe8e7c333e1ca26d028"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["abi-16.30","abi-16.29","abi-16.28","abi-16.27","abi-16.26","abi-16.25","abi-16.24","abi-16.23","abi-16.22","v26.07.0","abi-16.21","abi-16.20","abi-16.19","abi-16.18","abi-16.17","abi-16.16","abi-16.15","abi-16.14","abi-16.13","abi-16.11","abi-16.10","abi-16.9","abi-16.8","abi-16.7","abi-16.6","v26.02.0","abi-16.5","abi-16.4","abi-16.3","abi-16.2","abi-16","abi-15.2","abi-15.1","abi-15.0","abi-15","abi-14.0","abi-14","abi-13.0","abi-13","abi-12.27","abi-12.26","abi-12.25","abi-12.24","abi-12.23","abi-12.22","abi-12.21","abi-12.20","abi-12.19","abi-12.18","abi-12.17","abi-12.16","abi-12","testtag0.1","v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128240.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}