CVE-2025-52292

A stack buffer overflow in the fileinprocess function infile.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-55659

A NULL pointer dereference in the cttsboxwrite function isomedia/boxcodebase.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-52293

The GPAC MP4Box v2.4 multimedia packager contains a segmentation violation in the gf_hevc_read_sps_bs_internal function located in the media_tools/av_parsers.c file. This vulnerability is caused by uncontrolled resource consumption when processing specially crafted HEVC Sequence Parameter Set (SP...

CVE-2025-52293

A segmentation violaton in the gfhevcreadspsbsinternal function mediatools/avparsers.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying crafted HEVC SPS data...

GPAC MP4Box 处理逻辑错误漏洞

GPAC is an open-source multimedia framework developed by GPAC. Version 2.4 of GPAC contains a security vulnerability. This vulnerability stems from a floating-point exception in the gfopusparsepacketheader function, which could allow attackers to cause denial-of-service attacks through specially...

CVE-2025-55658

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfopusparsepacketheader function mediatools/avparsers.c. bThis vulnerability allows attackers to cause a Denial of Service DoS via a crafted MP4 file...

CVE-2025-55651

A NULL pointer dereference in the gfisomgetuserdatacount function isomedia/isomread.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-52292

A stack buffer overflow exists in the filein_process function (located in in_file.c ) of GPAC MP4Box v2.4 . This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted MP4 file . While the vulnerability is documented across multiple sources, the...

CVE-2025-52293

A segmentation violaton in the gfhevcreadspsbsinternal function mediatools/avparsers.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying crafted HEVC SPS data...

gpac:fuzz_scene: Segv on unknown address in gf_node_register

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5942827464065024 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: Segv on unknown address Crash Address: Crash State: gfnoderegister...

gpac:fuzz_scene: Heap-use-after-free in ReplaceDEFNode

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5905734247448576 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzscene Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x7576b4be0040 Crash...

PT-2026-56798

Name of the Vulnerable Software and Affected Versions GPAC version 26.03-DEV Description An issue exists in the MP4Box component within the vobsub read idx function of the /src/media tools/vobsub.c file. A local attacker can trigger an out-of-bounds read by manipulating the num langs argument. An...

gpac:fuzz_scene: Crash in gf_node_list_add_child

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6566986070163456 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x00009fffa010 Crash State: gfnodelistaddchild...

gpac:fuzz_scene: Stack-buffer-overflow in gf_mx2d_decompose

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5380081857134592 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: Stack-buffer-overflow READ 4 Crash Address: 0x77cfca3d01f8 Crash State:...

gpac:fuzz_scene: Heap-use-after-free in lsr_restore_base

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=4605349750702080 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzscene Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x746bc8ce0db0 Crash...

CVE-2025-60477

A NULL pointer dereference in the gffilterpidresolvefiletemplateex function /filtercore/filterpid.c of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service DoS via supplying a crafted file...

CVE-2026-7135

A security flaw has been discovered in GPAC up to 26.03-DEV-rev105-g8f39a1eb3-master. Affected by this vulnerability is the function elngboxread of the file src/isomedia/boxcodebase.c of the component MP4Box. Performing a manipulation of the argument elng results in out-of-bounds read. The attack...

CVE-2026-9567

A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isomintern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the publ...

CVE-2026-8124

A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidxboxread of the file src/isomedia/boxcodebase.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The...

gpac:fuzz_scene: Heap-use-after-free in ReplaceDEFNode

Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=6669904425320448 Project: gpac Fuzzing Engine: afl Fuzz Target: fuzzscene Job Type: aflasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x77d1a8ce0100 Crash State:...