CVE-2025-60465 | Medium | 6.1 | 2026-06-25 | A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial o… |
CVE-2025-60464 | High | 7.8 | 2026-06-25 | A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-60473 | Medium | 5.5 | 2026-06-25 | A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus… |
CVE-2025-60466 | Medium | 5.0 | 2026-06-25 | A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-60474 | High | 7.5 | 2026-06-24 | A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Servi… |
CVE-2025-60467 | High | 7.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus… |
CVE-2025-60468 | Medium | 5.5 | 2026-06-24 | GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of ser… |
CVE-2025-60471 | Medium | 5.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to c… |
CVE-2025-55639 | Medium | 6.5 | 2026-06-23 | GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability all… |
CVE-2025-55663 | Medium | 5.5 | 2026-06-15 | A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-55661 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafte… |
CVE-2025-55660 | Medium | 5.5 | 2026-06-15 | A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2025-55652 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via s… |
CVE-2025-55650 | Medium | 5.5 | 2026-06-15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55649 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… |
CVE-2025-55648 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service… |
CVE-2025-55647 | Medium | 5.5 | 2026-06-15 | An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supp… |
CVE-2025-55645 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2025-55644 | Medium | 5.5 | 2026-06-15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55643 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-55642 | Medium | 6.5 | 2026-06-15 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c). |
CVE-2025-55641 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (… |
CVE-2025-55659 | Medium | 6.5 | 2026-06-09 | A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55658 | Medium | 6.5 | 2026-06-09 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c). bThis vulnerabili… |
CVE-2025-55657 | High | 7.5 | 2026-06-09 | A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… |
CVE-2025-55651 | Medium | 5.5 | 2026-06-09 | A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service… |
CVE-2025-52293 | High | 7.5 | 2026-06-09 | A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Servi… |
CVE-2025-52292 | High | 7.5 | 2026-06-09 | A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a craf… |
CVE-2026-9572 | Low | 3.3 | 2026-05-26 | A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the… |
CVE-2026-8124 | Low | 3.3 | 2026-05-08 | A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipul… |
CVE-2026-39103 | Medium | 5.5 | 2026-05-05 | Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scene… |
CVE-2026-33144 | Medium | 5.8 | 2026-03-20 | GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vul… |
CVE-2026-27821 | High | 7.8 | 2026-02-26 | GPAC is an open-source multimedia framework. In versions up to and including 26.02.0, a stack buffer overflow occurs during NHML file parsing in `src/filters/d… |
CVE-2026-1418 | Medium | 5.3 | 2026-01-26 | A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c… |
CVE-2026-1417 | Low | 3.3 | 2026-01-26 | A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manip… |
CVE-2026-1416 | Low | 3.3 | 2026-01-26 | A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump… |
CVE-2026-1415 | Low | 3.3 | 2026-01-26 | A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The ma… |
CVE-2025-70303 | Medium | 5.5 | 2026-01-15 | A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. |
CVE-2025-70302 | Medium | 5.5 | 2026-01-15 | A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-70307 | High | 7.5 | 2026-01-15 | A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet. |
CVE-2025-70299 | Medium | 6.5 | 2026-01-15 | A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file. |
CVE-2025-70310 | Medium | 5.5 | 2026-01-15 | A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .ogg file. |
CVE-2025-70309 | Medium | 5.5 | 2026-01-15 | A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted WAV file. |
CVE-2025-70308 | High | 7.5 | 2026-01-15 | An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file. |
CVE-2025-70305 | Medium | 5.5 | 2026-01-15 | A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file. |
CVE-2025-70304 | High | 7.5 | 2026-01-15 | A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet. |
CVE-2025-70298 | High | 8.2 | 2026-01-15 | GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function. |
CVE-2025-7797 | Medium | 5.3 | 2025-07-18 | A vulnerability was found in GPAC up to 2.4. It has been rated as problematic. Affected by this issue is the function gf_dash_download_init_segment of the file… |
CVE-2025-25723 | High | 8.4 | 2025-02-28 | Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code. |
CVE-2024-57184 | Medium | 5.5 | 2025-01-24 | An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_process_pmt in media_tools/mpegts.c:2163… |
CVE-2024-50665 | Medium | 5.5 | 2025-01-23 | gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box. |
CVE-2024-50664 | High | 7.8 | 2025-01-23 | gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box. |
CVE-2023-4679 | Medium | 5.5 | 2024-11-15 | A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38… |
CVE-2024-6064 | Medium | 5.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end o… |
CVE-2024-6063 | Low | 3.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the fi… |
CVE-2024-6062 | Low | 3.3 | 2024-06-17 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample… |
CVE-2024-6061 | Low | 3.3 | 2024-06-17 | A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_p… |
CVE-2024-28319 | Medium | 6.2 | 2024-03-15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/dash_client.c:6374 |
CVE-2024-28318 | High | 7.1 | 2024-03-15 | gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325 |
CVE-2023-46427 | Critical | 9.8 | 2024-03-09 | An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), a… |
CVE-2023-46426 | High | 8.8 | 2024-03-09 | Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code and cause a denial… |
CVE-2024-24267 | High | 7.5 | 2024-02-05 | gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function. |
CVE-2024-24266 | High | 7.5 | 2024-02-05 | gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c. |
CVE-2024-24265 | High | 7.5 | 2024-02-05 | gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function. |
CVE-2024-22749 | High | 7.8 | 2024-01-25 | GPAC v2.3 was detected to contain a buffer overflow via the function gf_isom_new_generic_sample_description function in the isomedia/isom_write.c:4577 |
CVE-2023-50120 | Medium | 5.5 | 2024-01-10 | MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvlc at media_tools/av_parsers.c. This vuln… |
CVE-2024-0322 | Critical | 9.1 | 2024-01-08 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2024-0321 | Critical | 9.8 | 2024-01-08 | Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-46929 | High | 7.5 | 2024-01-03 | An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers… |
CVE-2023-46932 | Critical | 9.8 | 2023-12-09 | Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (… |
CVE-2023-47465 | Medium | 5.5 | 2023-12-09 | An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file src/isomedia/box_code_bas… |
CVE-2023-48958 | Medium | 5.5 | 2023-12-07 | gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf_mpd_resolve_url media_tools/mpd.c:4589. |
CVE-2023-46871 | Medium | 5.3 | 2023-12-07 | GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml_tools.c:300. This vulnerability may lead to a den… |
CVE-2023-48090 | High | 7.1 | 2023-11-20 | GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329. |
CVE-2023-48039 | Medium | 5.5 | 2023-11-20 | GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75. |
CVE-2023-48014 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c. |
CVE-2023-48013 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c. |
CVE-2023-48011 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments… |
CVE-2023-47384 | Medium | 5.5 | 2023-11-14 | MP4Box GPAC v2.3-DEV-rev617-g671976fcc-master was discovered to contain a memory leak in the function gf_isom_add_chapter at /isomedia/isom_write.c. This vulne… |
CVE-2023-46001 | Medium | 5.5 | 2023-11-07 | Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/… |
CVE-2023-5998 | High | 7.5 | 2023-11-07 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-46928 | Medium | 5.5 | 2023-11-01 | GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42. |
CVE-2023-46927 | Medium | 5.5 | 2023-11-01 | GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box. |
CVE-2023-46931 | Medium | 5.5 | 2023-11-01 | GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in gpac/MP4Box. |
CVE-2023-46930 | Medium | 5.5 | 2023-11-01 | GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14. |
CVE-2023-5595 | Medium | 5.5 | 2023-10-16 | Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-5586 | High | 7.8 | 2023-10-15 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-42298 | Medium | 5.5 | 2023-10-12 | An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of file src/bifs/unquanti… |
CVE-2023-5520 | High | 7.7 | 2023-10-11 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. |
CVE-2023-5377 | High | 7.1 | 2023-10-04 | Out-of-bounds Read in GitHub repository gpac/gpac prior to v2.2.2-DEV. |
CVE-2023-41000 | Medium | 5.5 | 2023-09-11 | GPAC through 2.2.1 has a use-after-free vulnerability in the function gf_bifs_flush_command_list in bifs/memory_decoder.c. |
CVE-2023-4778 | Medium | 5.5 | 2023-09-05 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4758 | Medium | 5.5 | 2023-09-04 | Buffer Over-read in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4755 | Medium | 5.5 | 2023-09-04 | Use After Free in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4756 | Medium | 5.5 | 2023-09-04 | Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4754 | Medium | 5.5 | 2023-09-04 | Out-of-bounds Write in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4722 | Medium | 5.5 | 2023-09-01 | Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4721 | Medium | 5.5 | 2023-09-01 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4720 | Medium | 5.5 | 2023-09-01 | Floating Point Comparison with Incorrect Operator in GitHub repository gpac/gpac prior to 2.3-DEV. |
CVE-2023-4683 | Medium | 5.5 | 2023-08-31 | NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3-DEV. |