CVE Tools
Track your stack

Gpac

367 CVEs tracked since 2018. Since Jun 2018, none of them reached CISA KEV.

Gpac CVEs per month

Jun 2018 to Jun 2026. Point at a month, or focus the strip and use the arrow keys.
Gpac CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2018-0620
2018-07null or fewer
2018-08null or fewer
2018-09null or fewer
2018-10null or fewer
2018-11null or fewer
2018-12null or fewer
2019-01null or fewer
2019-02null or fewer
2019-03null or fewer
2019-04null or fewer
2019-0530
2019-06null or fewer
2019-07null or fewer
2019-08null or fewer
2019-0930
2019-10null or fewer
2019-11null or fewer
2019-12130
2020-0130
2020-02null or fewer
2020-0350
2020-04null or fewer
2020-05null or fewer
2020-06null or fewer
2020-07null or fewer
2020-08null or fewer
2020-09null or fewer
2020-10null or fewer
2020-11null or fewer
2020-12null or fewer
2021-01null or fewer
2021-02null or fewer
2021-03null or fewer
2021-04250
2021-05null or fewer
2021-06null or fewer
2021-07null or fewer
2021-08360
2021-09220
2021-1090
2021-11null or fewer
2021-12220
2022-01460
2022-02null or fewer
2022-0380
2022-0470
2022-0540
2022-0680
2022-0730
2022-0830
2022-0930
2022-1060
2022-1170
2022-12null or fewer
2023-01250
2023-0270
2023-03null or fewer
2023-04null or fewer
2023-0560
2023-06null or fewer
2023-0750
2023-0850
2023-0990
2023-1050
2023-11120
2023-1240
2024-0150
2024-02null or fewer
2024-03null or fewer
2024-04null or fewer
2024-05null or fewer
2024-0640
2024-07null or fewer
2024-08null or fewer
2024-09null or fewer
2024-10null or fewer
2024-11null or fewer
2024-12null or fewer
2025-01null or fewer
2025-02null or fewer
2025-03null or fewer
2025-04null or fewer
2025-05null or fewer
2025-06null or fewer
2025-07null or fewer
2025-08null or fewer
2025-09null or fewer
2025-10null or fewer
2025-11null or fewer
2025-12null or fewer
2026-01140
2026-02null or fewer
2026-03null or fewer
2026-04null or fewer
2026-05null or fewer
2026-06280

Products

The products that kept showing up in Gpac's monthly top three, with their CVEs summed over those months.

  1. Gpac36334 months
  2. Gpac/gpac4214 months
  3. MP4BOX42 months

Latest CVEs

The 15 most recently published vulnerabilities affecting Gpac.

  1. CVE-2026-79514An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab2...6.5
  2. CVE-2026-79513A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD S...6.5
  3. CVE-2026-79522An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in...6.5
  4. CVE-2025-60465A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafte...6.1
  5. CVE-2025-60464A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a craf...7.8
  6. CVE-2025-60468GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filter...5.5
  7. CVE-2025-60467A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supply...7.5
  8. CVE-2025-60471A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via sup...5.5
  9. CVE-2025-60474A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.7.5
  10. CVE-2025-60466A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a craft...5.0
  11. CVE-2025-60473A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supply...5.5
  12. CVE-2025-55639GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Ser...6.5
  13. CVE-2025-55648A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.5.5
  14. CVE-2025-55642GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c).6.5
  15. CVE-2025-55645A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.5.5

The record

Peak rank
#22 in Jan 2022
Busiest month shown
Jan 2022, 46 CVEs
Months with a KEV entry
0 since Jun 2018
Monthly snapshots
34 since 2018
Gpac's full record, month by month

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store