CVE-2025-55653

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function utils/error.c. Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac to divide by zero, terminating the process with SIGFPE...

CVE-2025-55640

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-55653

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function utils/error.c. Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac to divide by zero, terminating the process with SIGFPE...

CVE-2025-55640

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-211111

A heap buffer overflow in the stblAddSize function isomedia/stblwrite.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

EUVD-2025-211112

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gfparselfrac function utils/error.c. Processing a crafted MP4 file containing a zero-denominator fraction string causes gfparselfrac to divide by zero, terminating the process with SIGFPE...

PT-2026-116126

GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf parse lfrac function utils/error.c. Processing a crafted MP4 file containing a zero-denominator fraction string causes gf parse lfrac to divide by zero, terminating the process with SIGFPE...

PT-2026-116125

A heap buffer overflow in the stbl AddSize function isomedia/stbl write.c of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2025-55653

GPAC MP4Box v2.4 contains a floating point exception within the gf_parse_lfrac function located in utils/error.c. The vulnerability is triggered when the software processes a crafted MP4 file containing a fraction string with a zero-denominator , causing the application to divide by zero. This re...

CVE-2025-55640

GPAC MP4Box v2.4 is vulnerable to a heap buffer overflow in the stbl_AddSize function located in isomedia/stbl_write.c. An attacker can trigger a Denial of Service (DoS) by providing a specially crafted MP4 file. Remediation and specific exploit details are not provided in the documents.

EUVD-2026-78165

A vulnerability was identified in GPAC 26.07.0. This affects the function gfnodedeactivateex of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used...

CVE-2026-90826

A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gfnodedel of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and m...

CVE-2026-90827 GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free

A vulnerability was identified in GPAC 26.07.0. This affects the function gfnodedeactivateex of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used...

CVE-2026-90827 GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free

A vulnerability was identified in GPAC 26.07.0. This affects the function gfnodedeactivateex of the file scenegraph/basescenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack must be carried out locally. The exploit is publicly available and might be used...

CVE-2026-90827

GPAC 26.07.0 contains a use after free vulnerability in the function gf_node_deactivate_ex within the file scenegraph/base_scenegraph.c of the MP4Box component. The flaw is exploitable via a local attack with low complexity and low privileges required, resulting in a low impact on availability (C...

CVE-2026-90826 GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds

A vulnerability was determined in GPAC 26.07.0. Affected by this issue is the function gfnodedel of the file scenegraph/basescenegraph.c of the component MP4Box. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit has been publicly disclosed and m...

CVE-2026-90826

GPAC 26.07.0 contains an out-of-bounds read in the gf_node_del function within scenegraph/base_scenegraph.c (component MP4Box ). The flaw is triggered via local execution with low privileges and requires user interaction, resulting in a partial availability impact (denial of service). CVSS 3.1 sc...

CVE-2026-90825 GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public a...

CVE-2026-90825 GPAC MP4Box base_scenegraph.c gf_node_unregister use after free

A vulnerability was found in GPAC 26.07.0. Affected by this vulnerability is the function gfnodeunregister of the file scenegraph/basescenegraph.c of the component MP4Box. The manipulation results in use after free. The attack is only possible with local access. The exploit has been made public a...

CVE-2026-90824

GPAC 26.07.0 contains a stack-based buffer overflow in the function gf_sg_dom_event_bubble (file src/scenegraph/dom_events.c) within the MP4Box component. The flaw is exploitable only from a local environment and results in low availability impact (no confidentiality or integrity loss), yielding ...