Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master Commit 3f056542b377cc73677d19490bfe1b46c52c9be7 Fixed: a2e5c62c213b5329a4572fe8e7c333e1ca26d028 CVE: CVE-2026-128240 CWE: CWE-416 (Use After Free) CVSS 3.1: 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Reporter: Alexander A. Shvedov (@sigdevel) Description: After...
CVE-2026-128240: GPAC/MP4Box: Use-After-Free in gf_sg_proto_del During XMT Scene Teardown
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/711
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
libdca (VideoLAN DTS decoder, unmaintained): out-of-bounds read in scale-factor parsing
Posted by Osvaldo J. Filho on Nov 14 Hi, libdca is VideoLAN's DTS Coherent Acoustics decoder. It's effectively unmaintained (VideoLAN confirmed to me it's abandoned and…
CVE-2015-10149: Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine
Posted by Robert Rothenberg on Nov 14 CVE-2015-10149 CPAN Security Group CVE ID: CVE-2015-10149 Distribution: Dancer Versions: before 1.3400 MetaCPAN…
CVE-2026-124031: GPAC/MP4Box: Type Confusion in Appearance Handling via Crafted XMT Input
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master…
CVE-2026-124030: GPAC/MP4Box: Type Confusion in XMT Field-Replace Commands
Posted by Alexander A. Shvedov on Nov 14 Product: GPAC (MP4Box) Affected: Through 26.07.0 (per the published CVE record) Reproduced on 26.08-DEV-rev263-g3f056542b-master…
CVE-2011-10042: HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached
Posted by Robert Rothenberg on Nov 14 CVE-2011-10042 CPAN Security Group CVE ID: CVE-2011-10042 Distribution: http-session Versions: before 0.43 MetaCPAN…
JSON-XS versions before 4.05 for Perl (7 CVEs)
Posted by Robert Rothenberg on Nov 14 CVE-2026-124536 JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a…