GP
Product
gpac
450
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 13High 147Medium 261Low 29
Watch
Add gpac to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-90577 | 5.3 | Sep 13 | GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow Affected: f1219cde |
| CVE-2026-7135 | 5.3 | Apr 27 | GPAC MP4Box box_code_base.c elng_box_read out-of-bounds Affected: 26.03-DEV-rev105-g8f39a1eb3-master |
| CVE-2026-4016 | 5.3 | Mar 12 | GPAC SVG Parser load_svg.c svgin_process out-of-bounds write Affected: 26.03-DEV |
| CVE-2026-4015 | 5.3 | Mar 12 | GPAC TeXML File load_text.c txtin_process_texml stack-based overflow Affected: 26.03-DEV |
| CVE-2025-7797 | 5.3 | Jul 18 | GPAC dash_client.c gf_dash_download_init_segment null pointer dereference Affected: through 2.4.0 |
| CVE-2023-46871 | 5.3 | Dec 7 | GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300 Affected: through 2.3-dev-rev602-ged8424300-master |
| CVE-2025-60466 | 5.0 | Jun 24 | A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via… Affected: before 26.02.0 |
| CVE-2022-1172 | 5.0 | Mar 30 | Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV Affected: through 2.0.0 |
| CVE-2026-91088 | 4.8 | Sep 15 | GPAC URL url.c gf_url_concatenate_ex heap-based overflow Affected: f1219cde |
| CVE-2026-91091 | 4.3 | Sep 15 | GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption Affected: f1219cde |
| CVE-2026-90792 | 4.3 | Sep 14 | GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference Affected: f1219cde |