CVE Intelligence

Vulnerabilidades de Gpac

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Gpac: 50 registro(s), com severidade, exploração e correções.

Gpac 50

Somente exploradas (KEV) →

CVE-2025-55659 Média · 6.5 CWE-476 09/06/2026
NULL Pointer Dereference em Gpac
A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2025-55658 Média · 6.5 CWE-1077 09/06/2026
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the…
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c). bThis vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
CVE-2025-55657 Alta · 7.5 CWE-476 09/06/2026
NULL Pointer Dereference em Gpac
A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2025-55651 Média · 5.5 CWE-476 09/06/2026
NULL Pointer Dereference em Gpac
A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2025-52293 Alta · 7.5 CWE-400 09/06/2026
Uncontrolled Resource Consumption em Gpac
A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying crafted HEVC SPS data.
CVE-2025-52292 Alta · 7.5 CWE-121 09/06/2026
Stack-based Buffer Overflow em Gpac
A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2026-9572 Média · 5.5 CWE-401 26/05/2026
GPAC MP4Box media.c Media_GetSample memory leak
A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.
CVE-2026-8124 Média · 5.5 CWE-400 07/05/2026
GPAC box_code_base.c sidx_box_read allocation of resources
A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a patch to address this issue.
CVE-2026-39103 Média · 5.5 CWE-122 05/05/2026
Heap-based Buffer Overflow em Gpac
Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_attributes.c, svg_parse_strings(), gf_svg_parse_attribute()
CVE-2026-33144 Alta · 7.8 CWE-787 20/03/2026
GPAC MP4Box Heap Buffer Overflow Write in gf_xml_parse_bit_sequence_bs (NHML BS Parsing)
GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML file, causing an out-of-bounds write on the heap. This issue has been via commit 86b0e36.
CVE-2026-27821 Alta · 7.8 CWE-121 25/02/2026
GPAC NHML Demuxer (dmx_nhml.c) Vulnerable to Stack Buffer Overflow
GPAC is an open-source multimedia framework. In versions up to and including 26.02.0, a stack buffer overflow occurs during NHML file parsing in `src/filters/dmx_nhml.c`. The value of the xmlHeaderEnd XML attribute is copied from att->value into szXmlHeaderEnd[1000] using strcpy() without any length validation. If the input exceeds 1000 bytes, it overwrites beyond the stack buffer boundary. Commit 9bd7137fded2db40de61a2cf3045812c8741ec52 patches the issue.
CVE-2026-1418 Alta · 7.8 CWE-787 26/01/2026
GPAC SRT Subtitle Import text_to_bifs.c gf_text_import_srt_bifs out-of-bounds write
A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue.
CVE-2026-1417 Baixa · 3.3 CWE-476 26/01/2026
GPAC filedump.c dump_isom_rtp null pointer dereference
A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: f96bd57c3ccdcde4335a0be28cd3e8fe296993de. Applying a patch is the recommended action to fix this issue.
CVE-2026-1416 Baixa · 3.3 CWE-476 26/01/2026
GPAC filedump.c DumpMovieInfo null pointer dereference
A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as d45c264c20addf0c1cc05124ede33f8ffa800e68. It is advisable to implement a patch to correct this issue.
CVE-2026-1415 Baixa · 3.3 CWE-476 26/01/2026
GPAC media_export.c gf_media_export_webvtt_metadata null pointer dereference
A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix this issue, it is recommended to deploy a patch.
CVE-2025-70303 Média · 5.5 CWE-122 15/01/2026
Heap-based Buffer Overflow em Gpac
A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.
CVE-2025-70302 Média · 5.5 CWE-122 15/01/2026
Heap-based Buffer Overflow em Gpac
A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2025-70307 Alta · 7.5 CWE-121 15/01/2026
Stack-based Buffer Overflow em Gpac
A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVE-2025-70299 Média · 6.5 CWE-122 15/01/2026
Heap-based Buffer Overflow em Gpac
A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.
CVE-2025-70310 Média · 5.5 CWE-122 15/01/2026
Heap-based Buffer Overflow em Gpac
A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .ogg file.
CVE-2025-70309 Média · 5.5 CWE-121 15/01/2026
Stack-based Buffer Overflow em Gpac
A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted WAV file.
CVE-2025-70308 Alta · 7.5 CWE-125 15/01/2026
Out-of-bounds Read em Gpac
An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file.
CVE-2025-70305 Média · 5.5 CWE-121 15/01/2026
Stack-based Buffer Overflow em Gpac
A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file.
CVE-2025-70304 Alta · 7.5 CWE-121 15/01/2026
Stack-based Buffer Overflow em Gpac
A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet.
CVE-2025-70298 Alta · 8.2 CWE-125 15/01/2026
Out-of-bounds Read em Gpac
GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function.