Threats tagged 'ghsa-ffqp-3677-6hc6'

GPAC versions up to 26.07.0 have a use-after-free vulnerability in the function gf_sg_proto_del() located in src/scenegraph/vrml_proto.c. This occurs because gf_sg_reset() frees unregistered prototypes that are still referenced by scene commands. An attacker can exploit this by supplying a crafted XMT/BT scene with prototype declarations processed by MP4Box -chap, causing a crash due to freed memory access.