GPAC through version 26.07.0 contains a type confusion flaw in the gf_sg_command_apply function within the scenegraph command processing module. The failure to verify that BIFS field‑replace command types match the target node fields permits an attacker to supply a specially crafted XMT file that, when processed by the MP4Box tool, causes gf_sg_vrml_field_clone() to perform an invalid memcpy and crash the application. This results in a loss of availability; the vulnerability does not provide a path to disclose sensitive data or achieve arbitrary code execution.

GPAC version 26.07.0 and all earlier releases, as identified by the cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:* entry. Users running these releases are exposed to the type‑confusion flaw.

The CVSS base score of 6.8 indicates moderate severity. The EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the weakness by delivering a malicious XMT file that is opened with MP4Box, such as through a chapter import or similar feature. The exploitation requires the victim to open the crafted file, implying a user‑interaction or local environment vector, which limits the likelihood of automated attacks but still poses a significant risk in contexts where media processing is critical.