Gpac

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Gpac product.

RSS Feeds for Gpac security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Gpac products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Gpac Sorted by Most Security Vulnerabilities since 2018

Gpac422 vulnerabilities

Gpac Mp4box75 vulnerabilities

By the Year

In 2026 there have been 124 vulnerabilities in Gpac with an average score of 5.4 out of ten. Last year, in 2025 Gpac had 6 security vulnerabilities published. That is, 118 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.85

Year	Vulnerabilities	Average Score
2026	124	5.35
2025	6	6.20
2024	17	6.90
2023	84	6.76
2022	98	6.20
2021	116	6.75
2020	9	5.50
2019	23	7.03
2018	3	9.80

It may take a day or so for new Gpac vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Gpac Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2025-71438	Oct 21, 2026	MP4Box prev26.07.0: OOB Read gf_odf_ac4_cfg_dsi_v1 DoS An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.	Mp4box
CVE-2025-60491	Oct 21, 2026	GPAC MP4Box <2.5 Heap UAF in dasher_flush_segment causes DoS A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.	Mp4box
CVE-2025-60497	Oct 21, 2026	GPAC MP4Box <2.5 DoS via GetESD segfault A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.	Mp4box
CVE-2025-60478	Oct 21, 2026	Use-After-Free in GPAC MP4Box <2.5 gf_filter_packet_destroy DoS A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.	Mp4box
CVE-2025-60492	Oct 21, 2026	GPAC MP4Box <2.5 Stack Overflow in gf_bifs_dec_node Causes DoS A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.	Mp4box
CVE-2025-60493	Oct 21, 2026	GPAC MP4Box 2.4 Segmentation Violation in check_media_profile DoS A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.	Mp4box
CVE-2025-60487	Oct 21, 2026	GPAC MP4Box <2.5 Segfault via gf_isom_get_esd (CVE-2025-60487) A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted XML file.	Mp4box
CVE-2025-60479	Oct 21, 2026	GPAC MP4Box <=2.5 DoS via NULL ptr in StatSFVec2f A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file.	Mp4box
CVE-2025-60490	Oct 21, 2026	GPAC MP4Box <2.5 Heap UAF in gf_filter_pid_send_event_downstream: DoS A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.	Mp4box
CVE-2025-60489	Oct 21, 2026	GPAC MP4Box <2.5 NULL Pointer Deref in dasher_insert_timeline_entry (DoS) A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.	Mp4box