# GPAC.

Every CVE that names GPAC among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write](https://agentprime.io/advisories/CVE-2026-109827.md)
  `CVE-2026-109827` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Memory corruption
- [GPAC MP4Box filter_queue.c gf_fq_pop use after free](https://agentprime.io/advisories/CVE-2026-108539.md)
  `CVE-2026-108539` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption
- [GPAC MP4Box os_thread.c gf_mx_v use after free](https://agentprime.io/advisories/CVE-2026-108538.md)
  `CVE-2026-108538` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Memory corruption
- [GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow](https://agentprime.io/advisories/CVE-2026-103227.md)
  `CVE-2026-103227` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Memory corruption
- [GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds](https://agentprime.io/advisories/CVE-2026-93331.md)
  `CVE-2026-93331` · CVE record: GPAC · CVSS 6.9 Medium · Not analysed yet · Published 18 Sept 2026 · Tags: Memory corruption
- [GPAC downloader.c wait_for_header_and_parse out-of-bounds](https://agentprime.io/advisories/CVE-2026-92475.md)
  `CVE-2026-92475` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free](https://agentprime.io/advisories/CVE-2026-92474.md)
  `CVE-2026-92474` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [GPAC BIFS commands.c gf_sg_command_del use after free](https://agentprime.io/advisories/CVE-2026-92473.md)
  `CVE-2026-92473` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free](https://agentprime.io/advisories/CVE-2026-92472.md)
  `CVE-2026-92472` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow](https://agentprime.io/advisories/CVE-2026-92399.md)
  `CVE-2026-92399` · CVE record: GPAC · CVSS 6.9 Medium · Not analysed yet · Published 16 Sept 2026 · Tags: Memory corruption
- [GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption](https://agentprime.io/advisories/CVE-2026-91091.md)
  `CVE-2026-91091` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow](https://agentprime.io/advisories/CVE-2026-91090.md)
  `CVE-2026-91090` · CVE record: GPAC · CVSS 2.4 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [GPAC base_scenegraph.c gf_node_get_name_and_id use after free](https://agentprime.io/advisories/CVE-2026-91089.md)
  `CVE-2026-91089` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [GPAC URL url.c gf_url_concatenate_ex heap-based overflow](https://agentprime.io/advisories/CVE-2026-91088.md)
  `CVE-2026-91088` · CVE record: GPAC · CVSS 2.4 Low · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [GPAC Compositor media_object.c gf_mo_get_od_id use after free](https://agentprime.io/advisories/CVE-2026-91087.md)
  `CVE-2026-91087` · CVE record: GPAC · CVSS 6.9 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow](https://agentprime.io/advisories/CVE-2026-91086.md)
  `CVE-2026-91086` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 15 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free](https://agentprime.io/advisories/CVE-2026-90827.md)
  `CVE-2026-90827` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds](https://agentprime.io/advisories/CVE-2026-90826.md)
  `CVE-2026-90826` · CVE record: GPAC · CVSS 2.4 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_unregister use after free](https://agentprime.io/advisories/CVE-2026-90825.md)
  `CVE-2026-90825` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow](https://agentprime.io/advisories/CVE-2026-90824.md)
  `CVE-2026-90824` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box vrml_tools.c gf_sg_script_load use after free](https://agentprime.io/advisories/CVE-2026-90794.md)
  `CVE-2026-90794` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_get_name use after free](https://agentprime.io/advisories/CVE-2026-90793.md)
  `CVE-2026-90793` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference](https://agentprime.io/advisories/CVE-2026-90792.md)
  `CVE-2026-90792` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_unregister use after free](https://agentprime.io/advisories/CVE-2026-90791.md)
  `CVE-2026-90791` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free](https://agentprime.io/advisories/CVE-2026-90687.md)
  `CVE-2026-90687` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box loader_bt.c gf_bt_report memory corruption](https://agentprime.io/advisories/CVE-2026-90686.md)
  `CVE-2026-90686` · CVE record: GPAC · CVSS 6.9 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion](https://agentprime.io/advisories/CVE-2026-90685.md)
  `CVE-2026-90685` · CVE record: GPAC · CVSS 2.4 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion](https://agentprime.io/advisories/CVE-2026-90684.md)
  `CVE-2026-90684` · CVE record: GPAC · CVSS 2.4 Low · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [GPAC MP4Box base_scenegraph.c gf_node_unregister assertion](https://agentprime.io/advisories/CVE-2026-90683.md)
  `CVE-2026-90683` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion](https://agentprime.io/advisories/CVE-2026-90613.md)
  `CVE-2026-90613` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion](https://agentprime.io/advisories/CVE-2026-90612.md)
  `CVE-2026-90612` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [GPAC MP4Box loader_xmt.c xmt_parse_element assertion](https://agentprime.io/advisories/CVE-2026-90611.md)
  `CVE-2026-90611` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read](https://agentprime.io/advisories/CVE-2026-90610.md)
  `CVE-2026-90610` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Memory corruption, CWE-126
- [GPAC MP4Box vrml_tools.c null pointer dereference](https://agentprime.io/advisories/CVE-2026-90609.md)
  `CVE-2026-90609` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service, Memory corruption
- [GPAC MP4Box list.c gf_list_count use after free](https://agentprime.io/advisories/CVE-2026-90578.md)
  `CVE-2026-90578` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow](https://agentprime.io/advisories/CVE-2026-90577.md)
  `CVE-2026-90577` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Memory corruption
- [GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference](https://agentprime.io/advisories/CVE-2026-90576.md)
  `CVE-2026-90576` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service, Memory corruption
- [GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference](https://agentprime.io/advisories/CVE-2026-90573.md)
  `CVE-2026-90573` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 13 Sept 2026 · Tags: Denial of service, Memory corruption
- [GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds](https://agentprime.io/advisories/CVE-2026-15185.md)
  `CVE-2026-15185` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 9 Jul 2026 · Tags: Memory corruption
- [GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overflow](https://agentprime.io/advisories/CVE-2025-15668.md)
  `CVE-2025-15668` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Memory corruption
- [GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double free](https://agentprime.io/advisories/CVE-2025-15667.md)
  `CVE-2025-15667` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Memory corruption
- [GPAC TeXML File load_text.c txtin_probe_duration divide by zero](https://agentprime.io/advisories/CVE-2026-14801.md)
  `CVE-2026-14801` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service
- [GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference](https://agentprime.io/advisories/CVE-2026-14790.md)
  `CVE-2026-14790` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Denial of service, Memory corruption
- [GPAC ISOBMFF base_encoding.c data amplification](https://agentprime.io/advisories/CVE-2026-13523.md)
  `CVE-2026-13523` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 29 Jun 2026 · Tags: Denial of service, CWE-409
- [GPAC MP4Box media.c Media_GetSample memory leak](https://agentprime.io/advisories/CVE-2026-9572.md)
  `CVE-2026-9572` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 26 May 2026 · Tags: Denial of service
- [GPAC MP4Box isom_intern.c MergeFragment null pointer dereference](https://agentprime.io/advisories/CVE-2026-9567.md)
  `CVE-2026-9567` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 26 May 2026 · Tags: Denial of service, Memory corruption
- [GPAC box_code_base.c sidx_box_read allocation of resources](https://agentprime.io/advisories/CVE-2026-8124.md)
  `CVE-2026-8124` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 8 May 2026 · Tags: Denial of service
- [GPAC MP4Box box_code_base.c elng_box_read out-of-bounds](https://agentprime.io/advisories/CVE-2026-7135.md)
  `CVE-2026-7135` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 27 Apr 2026 · Tags: Memory corruption
- [GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)](https://agentprime.io/advisories/CVE-2026-33144.md)
  `CVE-2026-33144` · CVE record: gpac gpac · CVSS 5.8 Medium · Not analysed yet · Published 20 Mar 2026 · Tags: Memory corruption
- [GPAC MP4Box swf_parse.c swf_def_bits_jpeg stack-based overflow](https://agentprime.io/advisories/CVE-2026-4185.md)
  `CVE-2026-4185` · CVE record: GPAC · CVSS 5.3 Medium · Not analysed yet · Published 15 Mar 2026 · Tags: Memory corruption
- [GPAC SVG Parser load_svg.c svgin_process out-of-bounds write](https://agentprime.io/advisories/CVE-2026-4016.md)
  `CVE-2026-4016` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [GPAC TeXML File load_text.c txtin_process_texml stack-based overflow](https://agentprime.io/advisories/CVE-2026-4015.md)
  `CVE-2026-4015` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 12 Mar 2026 · Tags: Memory corruption
- [GPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflow](https://agentprime.io/advisories/CVE-2026-27821.md)
  `CVE-2026-27821` · CVE record: gpac gpac · CVSS 7.7 High · Not analysed yet · Published 26 Feb 2026 · Tags: Memory corruption
- [GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write](https://agentprime.io/advisories/CVE-2026-1418.md)
  `CVE-2026-1418` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Memory corruption
- [GPAC filedump.c dump_isom_rtp null pointer dereference](https://agentprime.io/advisories/CVE-2026-1417.md)
  `CVE-2026-1417` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Denial of service, Memory corruption
- [GPAC filedump.c DumpMovieInfo null pointer dereference](https://agentprime.io/advisories/CVE-2026-1416.md)
  `CVE-2026-1416` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Denial of service, Memory corruption
- [GPAC media_export.c gf_media_export_webvtt_metadata null pointer dereference](https://agentprime.io/advisories/CVE-2026-1415.md)
  `CVE-2026-1415` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 26 Jan 2026 · Tags: Denial of service, Memory corruption
- [GPAC dash_client.c gf_dash_download_init_segment null pointer dereference](https://agentprime.io/advisories/CVE-2025-7797.md)
  `CVE-2025-7797` · CVE record: GPAC · CVSS 6.9 Medium · Not analysed yet · Published 18 Jul 2025 · Tags: Denial of service, Memory corruption
- [GPAC MP4Box loader_xmt.c xmt_node_end use after free](https://agentprime.io/advisories/CVE-2024-6064.md)
  `CVE-2024-6064` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 17 Jun 2024 · Tags: Memory corruption
- [GPAC MP4Box dmx_m2ts.c m2tsdmx_on_event null pointer dereference](https://agentprime.io/advisories/CVE-2024-6063.md)
  `CVE-2024-6063` · CVE record: GPAC · CVSS 4.8 Medium · Not analysed yet · Published 17 Jun 2024 · Tags: Memory corruption

Older: <https://agentprime.io/advisories/technology/gpac.md?cursor=WyIyMDI0LTA2LTE3VDIwOjMxOjA0LjMxNjAwMFoiLCJDVkUtMjAyNC02MDYzIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=gpac>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/gpac/>. Everything for agents: <https://agentprime.io/llms.txt>.