GPAC contains a type‑confusion bug where drawable_get_aspect_2d_mpeg4() and TraverseShape() cast a Shape’s appearance node to M_Appearance without verifying the node tag. An attacker can supply a crafted XMT file that places an unexpected node type, such as Conditional, in the appearance field. When MP4Box processes this file it attempts to read memory at an incorrect offset, causing an invalid memory read and a crash. The result of the exploit is a denial of service for the user or any automated processing pipeline that relies on MP4Box.

The issue is present in GPAC versions up through 26.07.0 inclusive. All builds of the gpac package that ship the compositor component are affected; no downstream products or specific configurations are distinguished. Users of MP4Box that consume external XMT files should consider themselves vulnerable.

The CVSS score of 6.8 classifies the vulnerability as moderate severity. EPSS data is not available, but the lack of a KEV listing and the lack of an identified zero‑day exploit reduce the overall risk. The attack vector is inferred to be file‑based; the attacker must supply a malicious XMT file that MP4Box reads. No authentication or privilege escalation is required, and the damage is limited to service disruption rather than data loss or confidentiality compromise.