GP
Product
gpac
450
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 13High 147Medium 261Low 29
Watch
Add gpac to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-28318 | 7.1 | Mar 15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325 Affected: 2.3-dev-rev921-g422b78ecf-master |
| CVE-2023-48090 | 7.1 | Nov 20 | GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329 Affected: 2.3-dev-rev617-g671976fcc-master |
| CVE-2023-5377 | 7.1 | Oct 4 | Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV Affected: through 2.2.1 |
| CVE-2023-3523 | 7.1 | Jul 6 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2 Affected: through 2.2.1 |
| CVE-2023-3013 | 7.1 | May 31 | Unchecked Return Value in GitHub repository gpac/gpac prior to 2.2.2 Affected: before 2.2.2 |
| CVE-2022-47092 | 7.1 | Jan 5 | GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8316 Affected: before 2.2.0 |
| CVE-2022-30976 | 7.1 | May 18 | GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcslen) function in utils/utf.c, resulting in a heap-based buffer over-read, as demonstrated by MP4Box Affected: 2.0.0 |
| CVE-2020-23267 | 7.1 | Sep 22 | An issue was discovered in gpac 0.8.0 Affected: 0.8.0 |
| CVE-2020-23931 | 7.1 | Apr 21 | An issue was discovered in gpac before 1.0.1 Affected: before 1.0.1 |
| CVE-2020-23928 | 7.1 | Apr 21 | An issue was discovered in gpac before 1.0.1 Affected: before 1.0.1 |
| CVE-2026-79522 | 6.5 | Sep 9 | An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP… Affected: 26.07.0 |
| CVE-2026-79513 | 6.5 | Sep 9 | A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS)… Affected: 26.07.0 |
| CVE-2026-79514 | 6.5 | Sep 9 | An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request Affected: 26.07.0 |
| CVE-2025-55639 | 6.5 | Jun 23 | GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c Affected: before 26.02.0 |
| CVE-2025-55642 | 6.5 | Jun 15 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c) Affected: before 26.02.0 |
| CVE-2025-55658 | 6.5 | Jun 9 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) Affected: 2.4 |
| CVE-2025-55659 | 6.5 | Jun 9 | A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: 2.4 |
| CVE-2025-70299 | 6.5 | Jan 15 | A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file Affected: 2.4.0 |
| CVE-2022-3957 | 6.5 | Nov 11 | A vulnerability classified as problematic was found in GPAC Affected: before 2.2.0 |
| CVE-2018-21017 | 6.5 | Sep 16 | GPAC 0.7.1 has a memory leak in dinf_Read in isomedia/box_code_base.c Affected: 0.7.1 |
| CVE-2018-21016 | 6.5 | Sep 16 | audio_sample_entry_AddBox() at isomedia/box_code_base.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via… Affected: 0.7.1 |
| CVE-2018-21015 | 6.5 | Sep 16 | AVC_DuplicateConfig() at isomedia/avc_ext.c in GPAC 0.7.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted file Affected: 0.7.1 |
| CVE-2026-109827 | 6.3 | Oct 13 | GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write Affected: 26.07 |
| CVE-2026-108539 | 6.3 | Oct 11 | GPAC MP4Box filter_queue.c gf_fq_pop use after free Affected: 26.07 |
| CVE-2026-108538 | 6.3 | Oct 11 | GPAC MP4Box os_thread.c gf_mx_v use after free Affected: 26.07 |
| CVE-2026-103227 | 6.3 | Sep 30 | GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow Affected: 26.07 |
| CVE-2026-91089 | 6.3 | Sep 15 | GPAC base_scenegraph.c gf_node_get_name_and_id use after free Affected: f1219cde |
| CVE-2026-91086 | 6.3 | Sep 15 | GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow Affected: f1219cde |
| CVE-2026-90794 | 6.3 | Sep 14 | GPAC MP4Box vrml_tools.c gf_sg_script_load use after free Affected: f1219cde |
| CVE-2026-90791 | 6.3 | Sep 14 | GPAC MP4Box base_scenegraph.c gf_node_unregister use after free Affected: f1219cde |
| CVE-2026-90687 | 6.3 | Sep 14 | GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free Affected: f1219cde |
| CVE-2026-4185 | 6.3 | Mar 15 | GPAC MP4Box swf_parse.c swf_def_bits_jpeg stack-based overflow Affected: 2.5-DEV-rev2167-gcc9d617c0-master |
| CVE-2024-28319 | 6.2 | Mar 15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374 Affected: 2.3-dev-rev921-g422b78ecf-master |
| CVE-2025-60465 | 6.1 | Jun 25 | A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via… Affected: before 26.02.0 |
| CVE-2025-60468 | 5.5 | Jun 24 | GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow Affected: before 26.02.0 |
| CVE-2025-60471 | 5.5 | Jun 24 | A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of… Affected: before 26.02.0 |
| CVE-2025-60473 | 5.5 | Jun 24 | A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of… Affected: before 26.02.0 |
| CVE-2025-55650 | 5.5 | Jun 15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55641 | 5.5 | Jun 15 | A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55643 | 5.5 | Jun 15 | A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55644 | 5.5 | Jun 15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55661 | 5.5 | Jun 15 | A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file Affected: before 26.02.0 |
| CVE-2025-55660 | 5.5 | Jun 15 | A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4… Affected: before 26.02.0 |
| CVE-2025-55645 | 5.5 | Jun 15 | A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4… Affected: before 26.02.0 |
| CVE-2025-55649 | 5.5 | Jun 15 | A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55648 | 5.5 | Jun 15 | A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying… Affected: before 26.02.0 |
| CVE-2025-55652 | 5.5 | Jun 15 | A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted… Affected: before 26.02.0 |
| CVE-2025-55647 | 5.5 | Jun 15 | An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4… Affected: before 26.02.0 |
| CVE-2025-55663 | 5.5 | Jun 15 | A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a… Affected: before 26.02.0 |
| CVE-2025-55651 | 5.5 | Jun 9 | A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying… Affected: 2.4 |