Advisories · Technology

GPAC.

Every CVE that names GPAC among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-109827 CVE record

CVSS 5.3 Medium

GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write
- GPAC
- Memory corruption
Not analysed yet 13 Oct 2026
CVE-2026-108539 CVE record

CVSS 5.3 Medium

GPAC MP4Box filter_queue.c gf_fq_pop use after free
- GPAC
- Memory corruption
Not analysed yet 11 Oct 2026
CVE-2026-108538 CVE record

CVSS 5.3 Medium

GPAC MP4Box os_thread.c gf_mx_v use after free
- GPAC
- Memory corruption
Not analysed yet 11 Oct 2026
CVE-2026-103227 CVE record

CVSS 5.3 Medium

GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow
- GPAC
- Memory corruption
Not analysed yet 30 Sept 2026
CVE-2026-93331 CVE record

CVSS 6.9 Medium

GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds
- GPAC
- Memory corruption
Not analysed yet 18 Sept 2026
CVE-2026-92475 CVE record

CVSS 4.8 Medium

GPAC downloader.c wait_for_header_and_parse out-of-bounds
- GPAC
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-92474 CVE record

CVSS 4.8 Medium

GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free
- GPAC
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-92473 CVE record

CVSS 4.8 Medium

GPAC BIFS commands.c gf_sg_command_del use after free
- GPAC
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-92472 CVE record

CVSS 4.8 Medium

GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
- GPAC
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-92399 CVE record

CVSS 6.9 Medium

GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow
- GPAC
- Memory corruption
Not analysed yet 16 Sept 2026
CVE-2026-91091 CVE record

CVSS 5.3 Medium

GPAC Node Insertion base_scenegraph.c gf_node_list_insert_child memory corruption
- GPAC
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-91090 CVE record

CVSS 2.4 Low

GPAC base_scenegraph.c gf_node_activate_ex stack-based overflow
- GPAC
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-91089 CVE record

CVSS 5.3 Medium

GPAC base_scenegraph.c gf_node_get_name_and_id use after free
- GPAC
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-91088 CVE record

CVSS 2.4 Low

GPAC URL url.c gf_url_concatenate_ex heap-based overflow
- GPAC
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-91087 CVE record

CVSS 6.9 Medium

GPAC Compositor media_object.c gf_mo_get_od_id use after free
- GPAC
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-91086 CVE record

CVSS 5.3 Medium

GPAC MPEG Video Reframer reframe_mpgvid.c mpgviddmx_process heap-based overflow
- GPAC
- Memory corruption
Not analysed yet 15 Sept 2026
CVE-2026-90827 CVE record

CVSS 4.8 Medium

GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90826 CVE record

CVSS 2.4 Low

GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90825 CVE record

CVSS 4.8 Medium

GPAC MP4Box base_scenegraph.c gf_node_unregister use after free
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90824 CVE record

CVSS 4.8 Medium

GPAC MP4Box dom_events.c gf_sg_dom_event_bubble stack-based overflow
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90794 CVE record

CVSS 5.3 Medium

GPAC MP4Box vrml_tools.c gf_sg_script_load use after free
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90793 CVE record

CVSS 5.3 Medium

GPAC MP4Box base_scenegraph.c gf_node_get_name use after free
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90792 CVE record

CVSS 5.3 Medium

GPAC MP4Box base_scenegraph.c gf_node_list_get_child null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90791 CVE record

CVSS 5.3 Medium

GPAC MP4Box base_scenegraph.c gf_node_unregister use after free
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90687 CVE record

CVSS 5.3 Medium

GPAC MP4Box base_scenegraph.c gf_node_changed_internal use after free
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90686 CVE record

CVSS 6.9 Medium

GPAC MP4Box loader_bt.c gf_bt_report memory corruption
- GPAC
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90685 CVE record

CVSS 2.4 Low

GPAC MP4Box lsr_dec.c lsr_exec_command_list assertion
- GPAC
- Denial of service
Not analysed yet 14 Sept 2026
CVE-2026-90684 CVE record

CVSS 2.4 Low

GPAC MP4Box base_scenegraph.c gf_node_get_field_count assertion
- GPAC
- Denial of service
Not analysed yet 14 Sept 2026
CVE-2026-90683 CVE record

CVSS 4.8 Medium

GPAC MP4Box base_scenegraph.c gf_node_unregister assertion
- GPAC
- Denial of service
Not analysed yet 14 Sept 2026
CVE-2026-90613 CVE record

CVSS 4.8 Medium

GPAC MP4Box stbl_read.c stbl_GetSampleInfos assertion
- GPAC
- Denial of service
Not analysed yet 14 Sept 2026
CVE-2026-90612 CVE record

CVSS 4.8 Medium

GPAC MP4Box scene_dump.c gf_sm_dump_command_list assertion
- GPAC
- Denial of service
Not analysed yet 14 Sept 2026
CVE-2026-90611 CVE record

CVSS 4.8 Medium

GPAC MP4Box loader_xmt.c xmt_parse_element assertion
- GPAC
- Denial of service
Not analysed yet 14 Sept 2026
CVE-2026-90610 CVE record

CVSS 4.8 Medium

GPAC MP4Box svg_attributes.c gf_svg_attributes_copy buffer over-read
- GPAC
- Memory corruption
- CWE-126
Not analysed yet 14 Sept 2026
CVE-2026-90609 CVE record

CVSS 4.8 Medium

GPAC MP4Box vrml_tools.c null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 14 Sept 2026
CVE-2026-90578 CVE record

CVSS 4.8 Medium

GPAC MP4Box list.c gf_list_count use after free
- GPAC
- Memory corruption
Not analysed yet 13 Sept 2026
CVE-2026-90577 CVE record

CVSS 4.8 Medium

GPAC MP4Box base_scenegraph.c gf_node_get_field heap-based overflow
- GPAC
- Memory corruption
Not analysed yet 13 Sept 2026
CVE-2026-90576 CVE record

CVSS 4.8 Medium

GPAC MP4Box base_scenegraph.c gf_node_list_add_child null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 13 Sept 2026
CVE-2026-90573 CVE record

CVSS 4.8 Medium

GPAC MP4Box vrml_tools.c gf_sg_mfurl_del null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 13 Sept 2026
CVE-2026-15185 CVE record

CVSS 4.8 Medium

GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds
- GPAC
- Memory corruption
Not analysed yet 9 Jul 2026
CVE-2025-15668 CVE record

CVSS 4.8 Medium

GPAC MP4Box box_code_base.c sgpd_del_entry heap-based overflow
- GPAC
- Memory corruption
Not analysed yet 6 Jul 2026
CVE-2025-15667 CVE record

CVSS 4.8 Medium

GPAC MP4Box avc_ext.c gf_isom_nalu_sample_rewrite double free
- GPAC
- Memory corruption
Not analysed yet 6 Jul 2026
CVE-2026-14801 CVE record

CVSS 4.8 Medium

GPAC TeXML File load_text.c txtin_probe_duration divide by zero
- GPAC
- Denial of service
Not analysed yet 6 Jul 2026
CVE-2026-14790 CVE record

CVSS 4.8 Medium

GPAC Media File write_nhml.c nhmldump_send_frame null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 6 Jul 2026
CVE-2026-13523 CVE record

CVSS 4.8 Medium

GPAC ISOBMFF base_encoding.c data amplification
- GPAC
- Denial of service
- CWE-409
Not analysed yet 29 Jun 2026
CVE-2026-9572 CVE record

CVSS 4.8 Medium

GPAC MP4Box media.c Media_GetSample memory leak
- GPAC
- Denial of service
Not analysed yet 26 May 2026
CVE-2026-9567 CVE record

CVSS 4.8 Medium

GPAC MP4Box isom_intern.c MergeFragment null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 26 May 2026
CVE-2026-8124 CVE record

CVSS 4.8 Medium

GPAC box_code_base.c sidx_box_read allocation of resources
- GPAC
- Denial of service
Not analysed yet 8 May 2026
CVE-2026-7135 CVE record

CVSS 4.8 Medium

GPAC MP4Box box_code_base.c elng_box_read out-of-bounds
- GPAC
- Memory corruption
Not analysed yet 27 Apr 2026
CVE-2026-33144 CVE record

CVSS 5.8 Medium

GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)
- gpac
- Memory corruption
Not analysed yet 20 Mar 2026
CVE-2026-4185 CVE record

CVSS 5.3 Medium

GPAC MP4Box swf_parse.c swf_def_bits_jpeg stack-based overflow
- GPAC
- Memory corruption
Not analysed yet 15 Mar 2026
CVE-2026-4016 CVE record

CVSS 4.8 Medium

GPAC SVG Parser load_svg.c svgin_process out-of-bounds write
- GPAC
- Memory corruption
Not analysed yet 12 Mar 2026
CVE-2026-4015 CVE record

CVSS 4.8 Medium

GPAC TeXML File load_text.c txtin_process_texml stack-based overflow
- GPAC
- Memory corruption
Not analysed yet 12 Mar 2026
CVE-2026-27821 CVE record

CVSS 7.7 High

GPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflow
- gpac
- Memory corruption
Not analysed yet 26 Feb 2026
CVE-2026-1418 CVE record

CVSS 4.8 Medium

GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write
- GPAC
- Memory corruption
Not analysed yet 26 Jan 2026
CVE-2026-1417 CVE record

CVSS 4.8 Medium

GPAC filedump.c dump_isom_rtp null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 26 Jan 2026
CVE-2026-1416 CVE record

CVSS 4.8 Medium

GPAC filedump.c DumpMovieInfo null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 26 Jan 2026
CVE-2026-1415 CVE record

CVSS 4.8 Medium

GPAC media_export.c gf_media_export_webvtt_metadata null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 26 Jan 2026
CVE-2025-7797 CVE record

CVSS 6.9 Medium

GPAC dash_client.c gf_dash_download_init_segment null pointer dereference
- GPAC
- Denial of service
- Memory corruption
Not analysed yet 18 Jul 2025
CVE-2024-6064 CVE record

CVSS 4.8 Medium

GPAC MP4Box loader_xmt.c xmt_node_end use after free
- GPAC
- Memory corruption
Not analysed yet 17 Jun 2024
CVE-2024-6063 CVE record

CVSS 4.8 Medium

GPAC MP4Box dmx_m2ts.c m2tsdmx_on_event null pointer dereference
- GPAC
- Memory corruption
Not analysed yet 17 Jun 2024