GP
Product
gpac
450
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 13High 147Medium 261Low 29
Watch
Add gpac to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-26967 | 7.8 | Mar 12 | GPAC 2.0 allows a heap-based buffer overflow in gf_base64_encode Affected: 2.0 |
| CVE-2021-40574 | 7.8 | Jan 13 | The binary MP4Box in Gpac from 0.9.0-preview to 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a… Affected: 0.9.0 through 1.0.1 |
| CVE-2021-40571 | 7.8 | Jan 13 | The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the ilst_box_read function in box_code_apple.c, which allows attackers to cause a denial of service, even code… Affected: 1.0.1 |
| CVE-2021-40570 | 7.8 | Jan 13 | The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the avc_compute_poc function in av_parsers.c, which allows attackers to cause a denial of service, even code… Affected: 1.0.1 |
| CVE-2021-40568 | 7.8 | Jan 13 | A buffer overflow vulnerability exists in Gpac through 1.0.1 via a malformed MP4 file in the svc_parse_slice function in av_parsers.c, which allows attackers to cause a denial of… Affected: through 1.0.1 |
| CVE-2021-36417 | 7.8 | Jan 12 | A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, which causes a denial of service or execute arbitrary code via… Affected: 1.0.1 |
| CVE-2021-36414 | 7.8 | Jan 10 | A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service or execute arbitrary code via a crafted… Affected: 1.0.1 |
| CVE-2021-36412 | 7.8 | Jan 10 | A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function, which allows attackers to possibly have unspecified… Affected: 1.0.1 |
| CVE-2021-32271 | 7.8 | Sep 20 | An issue was discovered in gpac through 20200801 Affected: before 1.0.1 |
| CVE-2021-32268 | 7.8 | Sep 20 | Buffer overflow vulnerability in function gf_fprintf in os_file.c in gpac before 1.0.1 allows attackers to execute arbitrary code Affected: before 1.0.1 |
| CVE-2021-33362 | 7.8 | Sep 13 | Stack buffer overflow in the hevc_parse_vps_extension function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file Affected: 1.0.1 |
| CVE-2021-32136 | 7.8 | Sep 13 | Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file Affected: 1.0.1 |
| CVE-2021-32439 | 7.8 | Aug 11 | Buffer overflow in the stbl_AppendSize function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file Affected: 1.0.1 |
| CVE-2020-35982 | 7.8 | Apr 21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1 Affected: 0.8.0; 1.0.1 |
| CVE-2020-35981 | 7.8 | Apr 21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1 Affected: 0.8.0; 1.0.1 |
| CVE-2020-35980 | 7.8 | Apr 21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1 Affected: 0.8.0; 1.0.1 |
| CVE-2020-35979 | 7.8 | Apr 21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1 Affected: 0.8.0; 1.0.1 |
| CVE-2021-29279 | 7.8 | Apr 19 | There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1 Affected: 1.0.1 |
| CVE-2021-31255 | 7.8 | Apr 19 | Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file Affected: 1.0.1 |
| CVE-2021-31254 | 7.8 | Apr 19 | Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid… Affected: 1.0.1 |
| CVE-2019-12483 | 7.8 | May 30 | An issue was discovered in GPAC 0.7.1 Affected: 0.6.1 through 0.7.1 |
| CVE-2019-11222 | 7.8 | Apr 15 | gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file Affected: 0.7.1 |
| CVE-2019-11221 | 7.8 | Apr 15 | GPAC 0.7.1 has a buffer overflow issue in gf_import_message() in media_import.c Affected: 0.7.1 |
| CVE-2018-20760 | 7.8 | Feb 6 | In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled Affected: through 0.7.1 |
| CVE-2018-7752 | 7.8 | Mar 7 | GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100 Affected: through 0.7.1 |
| CVE-2023-5520 | 7.7 | Oct 11 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2 Affected: before 2.2.2 |
| CVE-2025-60474 | 7.5 | Jun 24 | A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via… Affected: before 26.02.0 |
| CVE-2025-60467 | 7.5 | Jun 24 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of… Affected: before 26.02.0 |
| CVE-2025-52293 | 7.5 | Jun 9 | A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via… Affected: 2.4 |
| CVE-2025-52292 | 7.5 | Jun 9 | A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file Affected: 2.4 |
| CVE-2025-55657 | 7.5 | Jun 9 | A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: 2.4 |
| CVE-2025-70304 | 7.5 | Jan 15 | A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet Affected: 2.4.0 |
| CVE-2025-70308 | 7.5 | Jan 15 | An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file Affected: 2.4.0 |
| CVE-2025-70307 | 7.5 | Jan 15 | A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet Affected: 2.4.0 |
| CVE-2024-24267 | 7.5 | Feb 5 | gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function Affected: 2.2.1 before 2.4.0 |
| CVE-2024-24266 | 7.5 | Feb 5 | gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c Affected: 2.2.1 |
| CVE-2024-24265 | 7.5 | Feb 5 | gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function Affected: 2.2.1 |
| CVE-2023-46929 | 7.5 | Jan 3 | An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the… Affected: 2.3-dev-rev605-gfc9e29089-master |
| CVE-2023-5998 | 7.5 | Nov 7 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV Affected: before 2.3.0 |
| CVE-2023-2839 | 7.5 | May 22 | Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2 Affected: before 2.2.2 |
| CVE-2022-36186 | 7.5 | Aug 17 | A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_property_full () at filter_core/filter_pid.c:5250,which causes… Affected: 2.1 |
| CVE-2022-29340 | 7.5 | May 5 | GPAC 2.1-DEV-rev87-g053aae8-master Affected: before 2022-04-12 |
| CVE-2022-29339 | 7.5 | May 5 | In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service Affected: before 2022-04-12 |
| CVE-2021-45266 | 7.5 | Dec 22 | A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr_read_anim_values_ex function, which causes a segmentation fault and application crash Affected: 1.1.0 |
| CVE-2020-19750 | 7.5 | Sep 7 | An issue was discovered in gpac 0.8.0 Affected: 0.8.0 |
| CVE-2019-13618 | 7.5 | Jul 16 | In GPAC before 0.8.0, isomedia/isom_read.c in libgpac.a has a heap-based buffer over-read, as demonstrated by a crash in gf_m2ts_sync in media_tools/mpegts.c Affected: before 0.8.0 |
| CVE-2019-12482 | 7.5 | May 30 | An issue was discovered in GPAC 0.7.1 Affected: 0.6.1 through 0.7.1 |
| CVE-2026-93331 | 7.3 | Sep 18 | GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds Affected: 26.08-DEV |
| CVE-2026-92399 | 7.3 | Sep 16 | GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow Affected: 26.07.0 |
| CVE-2026-91087 | 7.3 | Sep 15 | GPAC Compositor media_object.c gf_mo_get_od_id use after free Affected: f1219cde |