GP
Product
gpac
450
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 13High 147Medium 261Low 29
Watch
Add gpac to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-35982 | 7.8 | Apr 21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1 Affected: 0.8.0; 1.0.1 |
| CVE-2020-35981 | 7.8 | Apr 21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1 Affected: 0.8.0; 1.0.1 |
| CVE-2020-35980 | 7.8 | Apr 21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1 Affected: 0.8.0; 1.0.1 |
| CVE-2020-35979 | 7.8 | Apr 21 | An issue was discovered in GPAC version 0.8.0 and 1.0.1 Affected: 0.8.0; 1.0.1 |
| CVE-2021-29279 | 7.8 | Apr 19 | There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1 Affected: 1.0.1 |
| CVE-2021-31255 | 7.8 | Apr 19 | Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file Affected: 1.0.1 |
| CVE-2021-31254 | 7.8 | Apr 19 | Buffer overflow in the tenc_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file, related invalid… Affected: 1.0.1 |
| CVE-2019-12483 | 7.8 | May 30 | An issue was discovered in GPAC 0.7.1 Affected: 0.6.1 through 0.7.1 |
| CVE-2019-11222 | 7.8 | Apr 15 | gf_bin128_parse in utils/os_divers.c in GPAC 0.7.1 has a buffer overflow issue for the crypt feature when encountering a crafted_drm_file.xml file Affected: 0.7.1 |
| CVE-2019-11221 | 7.8 | Apr 15 | GPAC 0.7.1 has a buffer overflow issue in gf_import_message() in media_import.c Affected: 0.7.1 |
| CVE-2018-20760 | 7.8 | Feb 6 | In GPAC 0.7.1 and earlier, gf_text_get_utf8_line in media_tools/text_import.c in libgpac_static.a allows an out-of-bounds write because a certain -1 return value is mishandled Affected: through 0.7.1 |
| CVE-2018-7752 | 7.8 | Mar 7 | GPAC through 0.7.1 has a Buffer Overflow in the gf_media_avc_read_sps function in media_tools/av_parsers.c, a different vulnerability than CVE-2018-1000100 Affected: through 0.7.1 |
| CVE-2023-5520 | 7.7 | Oct 11 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2 Affected: before 2.2.2 |
| CVE-2025-60474 | 7.5 | Jun 24 | A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via… Affected: before 26.02.0 |
| CVE-2025-60467 | 7.5 | Jun 24 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of… Affected: before 26.02.0 |
| CVE-2025-52293 | 7.5 | Jun 9 | A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via… Affected: 2.4 |
| CVE-2025-52292 | 7.5 | Jun 9 | A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file Affected: 2.4 |
| CVE-2025-55657 | 7.5 | Jun 9 | A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: 2.4 |
| CVE-2025-70304 | 7.5 | Jan 15 | A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet Affected: 2.4.0 |
| CVE-2025-70308 | 7.5 | Jan 15 | An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file Affected: 2.4.0 |
| CVE-2025-70307 | 7.5 | Jan 15 | A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet Affected: 2.4.0 |
| CVE-2024-24267 | 7.5 | Feb 5 | gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function Affected: 2.2.1 before 2.4.0 |
| CVE-2024-24266 | 7.5 | Feb 5 | gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c Affected: 2.2.1 |
| CVE-2024-24265 | 7.5 | Feb 5 | gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function Affected: 2.2.1 |
| CVE-2023-46929 | 7.5 | Jan 3 | An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the… Affected: 2.3-dev-rev605-gfc9e29089-master |
| CVE-2023-5998 | 7.5 | Nov 7 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV Affected: before 2.3.0 |
| CVE-2023-2839 | 7.5 | May 22 | Divide By Zero in GitHub repository gpac/gpac prior to 2.2.2 Affected: before 2.2.2 |
| CVE-2022-36186 | 7.5 | Aug 17 | A Null Pointer dereference vulnerability exists in GPAC 2.1-DEV-revUNKNOWN-master via the function gf_filter_pid_set_property_full () at filter_core/filter_pid.c:5250,which causes… Affected: 2.1 |
| CVE-2022-29340 | 7.5 | May 5 | GPAC 2.1-DEV-rev87-g053aae8-master Affected: before 2022-04-12 |
| CVE-2022-29339 | 7.5 | May 5 | In GPAC 2.1-DEV-rev87-g053aae8-master, function BS_ReadByte() in utils/bitstream.c has a failed assertion, which causes a Denial of Service Affected: before 2022-04-12 |
| CVE-2021-45266 | 7.5 | Dec 22 | A null pointer dereference vulnerability exists in gpac 1.1.0 via the lsr_read_anim_values_ex function, which causes a segmentation fault and application crash Affected: 1.1.0 |
| CVE-2020-19750 | 7.5 | Sep 7 | An issue was discovered in gpac 0.8.0 Affected: 0.8.0 |
| CVE-2019-13618 | 7.5 | Jul 16 | In GPAC before 0.8.0, isomedia/isom_read.c in libgpac.a has a heap-based buffer over-read, as demonstrated by a crash in gf_m2ts_sync in media_tools/mpegts.c Affected: before 0.8.0 |
| CVE-2019-12482 | 7.5 | May 30 | An issue was discovered in GPAC 0.7.1 Affected: 0.6.1 through 0.7.1 |
| CVE-2026-93331 | 7.3 | Sep 18 | GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds Affected: 26.08-DEV |
| CVE-2026-92399 | 7.3 | Sep 16 | GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow Affected: 26.07.0 |
| CVE-2026-91087 | 7.3 | Sep 15 | GPAC Compositor media_object.c gf_mo_get_od_id use after free Affected: f1219cde |
| CVE-2024-28318 | 7.1 | Mar 15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325 Affected: 2.3-dev-rev921-g422b78ecf-master |
| CVE-2023-48090 | 7.1 | Nov 20 | GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329 Affected: 2.3-dev-rev617-g671976fcc-master |
| CVE-2023-5377 | 7.1 | Oct 4 | Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV Affected: through 2.2.1 |
| CVE-2023-3523 | 7.1 | Jul 6 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2 Affected: through 2.2.1 |
| CVE-2023-3013 | 7.1 | May 31 | Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2 Affected: before 2.2.2 |
| CVE-2022-47092 | 7.1 | Jan 5 | GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8316 Affected: before 2.2.0 |
| CVE-2022-30976 | 7.1 | May 18 | GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-read, as demonstrated by MP4Box Affected: 2.0.0 |
| CVE-2020-23267 | 7.1 | Sep 22 | An issue was discovered in gpac 0.8.0 Affected: 0.8.0 |
| CVE-2020-23931 | 7.1 | Apr 21 | An issue was discovered in gpac before 1.0.1 Affected: before 1.0.1 |
| CVE-2020-23928 | 7.1 | Apr 21 | An issue was discovered in gpac before 1.0.1 Affected: before 1.0.1 |