Gpac vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-60464 A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial High 7.8 · Jun 25, 2026
• CVE-2025-60474 A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of ServicHigh 7.5 · Jun 24, 2026
• CVE-2025-60467 A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to causeHigh 7.5 · Jun 24, 2026
• CVE-2025-55657 A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vHigh 7.5 · Jun 9, 2026
• CVE-2025-52293 A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of ServicHigh 7.5 · Jun 9, 2026
• CVE-2025-52292 A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a craftHigh 7.5 · Jun 9, 2026
• CVE-2026-27821 GPAC is an open-source multimedia framework.High 7.7 · Feb 25, 2026
• CVE-2025-70307 A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.High 7.5 · Jan 15, 2026
• CVE-2025-70308 An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.High 7.5 · Jan 15, 2026
• CVE-2025-70304 A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.High 7.5 · Jan 15, 2026
• CVE-2025-70298 GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function.High 8.2 · Jan 15, 2026
• CVE-2025-25723 Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code.High 8.4 · Feb 28, 2025
• CVE-2024-50664 gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box.High 7.8 · Jan 23, 2025
• CVE-2024-28318 gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/swf_parse.c:325High 7.1 · Mar 15, 2024
• CVE-2023-46427 An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), anCritical 9.8 · Mar 9, 2024
• CVE-2023-46426 Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code and cause a denial High 8.8 · Mar 9, 2024
• CVE-2024-24267 gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio_blob variable in the gf_fileio_from_blob function.High 7.5 · Feb 5, 2024
• CVE-2024-24266 gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c.High 7.5 · Feb 5, 2024
• CVE-2024-24265 gpac v2.2.1 was discovered to contain a memory leak via the dst_props variable in the gf_filter_pid_merge_properties_internal function.High 7.5 · Feb 5, 2024
• CVE-2024-22749 GPAC v2.3 was detected to contain a buffer overflow via the function gf_isom_new_generic_sample_description function in the isomedia/isom_write.c:4577High 7.8 · Jan 25, 2024
• CVE-2024-0322 Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV.Critical 9.1 · Jan 8, 2024
• CVE-2024-0321 Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.Critical 9.8 · Jan 8, 2024
• CVE-2023-46929 An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers High 7.5 · Jan 3, 2024
• CVE-2023-46932 Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a denial of service (DCritical 9.8 · Dec 9, 2023
• CVE-2023-48090 GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329.High 7.1 · Nov 20, 2023