These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A security vulnerability has been detected in GPAC up to 26.07.0, impacting the function gf_mx_v of the file utils/os_thread.c in the MP4Box component, leading to a use after free vulnerability. The attack can be launched remotely, and the exploit has been disclosed publicly and may be used. Defenders responsible for GPAC installations, particularly those using MP4Box, should assess exposure and prioritiz [truncated]
A vulnerability was identified in GPAC 26.08-DEV, specifically in the gf_sg_command_del function of the BIFS Handler component. This issue leads to a use-after-free vulnerability, which can be exploited locally. The exploit is publicly available, and upgrading to version abi-16.24 resolves the issue. The patch identifier is e34f4ba349d55cd1849f0bcf4cf46552732e2db7.
A vulnerability was determined in GPAC 26.07.0, specifically in the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_size can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.26 is ab [truncated]
A CVE debrief for CVE-2026-79522, an out-of-bounds read vulnerability in GPAC v26.07.0 that allows for Denial of Service (DoS) via a crafted HTTP request. This vulnerability affects the gf_dm_get_chunk_data function in src/utils/downloader.c. Defenders should assess exposure and apply patches or updates to prevent potential Denial of Service (DoS) attacks. The vulnerability has a medium severity and a CVS [truncated]
A CVE debrief for CVE-2026-79514 was generated based on the supplied source corpus. The vulnerability is an out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0, which allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Defenders responsible for GPAC deployments, particularly those using version 26.07.0, should assess exposure and prior [truncated]
A divide-by-zero vulnerability in GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD SegmentTimeline. The vulnerability is fixed in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. This vulnerability affects systems using GPAC v26.07.0, particularly those handling MPD SegmentTimeline data. Defenders should assess exposure and prioritize verification of GPAC v26.07.0 usage. [truncated]
A denial of service vulnerability exists in GPAC version c2dee3aff638cd96f9617ac5b17dc2868cd90ef3. An attacker can exploit this vulnerability via the function gf_route_media_complete_object(). The issue was fixed in version 3c4e6c5b3e0c6fa9b16d55599701a08354538fab. This vulnerability allows attackers to cause a denial of service, which can have significant operational impacts. Defenders should prioritize [truncated]
A high-severity vulnerability in GPAC allows attackers to execute arbitrary code via the src/media_tools/dvb_mpe.c, descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() components. The issue was fixed in version 0e4093392e1f847c90d20e031e893cd942fef938. This vulnerability has a high CVSS score of 8.4, indicating significant risk. Defenders should prioritize verifying exposure and applying [truncated]
The CVE-2026-52489 vulnerability is a Buffer Overflow issue in gpac, specifically affecting the svgNameToImplementationName() function. This vulnerability allows an attacker to execute arbitrary code, with a CVSS score of 7.8 and HIGH severity. The CVE record was published on 2026-08-25T21:17:01.340Z. gpac users and administrators should review their configurations and ensure system security. Limited deta [truncated]
CVE-2026-50810 is a NULL pointer dereference vulnerability in smooth_parse_stream_index() in src/media_tools/mpd.c in GPAC master HEAD before commit b35c61f104b85fbb16520ac2838d5d2ef70845b5. This vulnerability allows attackers to cause a denial of service. The vulnerability is due to a NULL pointer being dereferenced in the smooth_parse_stream_index() function. Users of GPAC master HEAD before commit b35c [truncated]
A vulnerability was determined in GPAC up to 2.5-DEV, affecting the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of the component MP4Box, which can cause a double free when manipulating the argument nalu_out_bs. The exploit has been publicly disclosed and may be utilized. To fix this issue, it is recommended to deploy a patch.
CVE-2025-60465 is a use-after-free vulnerability in the gf_filter_pid_inst_swap function of GPAC Project/MP4Box before 26.02.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file. The vulnerability has a CVSS score of 6.1 and a severity of MEDIUM. The CVE was published on 2026-06-25T20:17:08.673Z and last modified on 2026-06-30T19:03:42.293Z. The vend [truncated]
CVE-2025-60473 is a MEDIUM severity vulnerability in GPAC Project MP4Box before 26.02.0. A NULL pointer dereference in the gf_filter_in_parent_chain function allows attackers to cause a Denial of Service (DoS) via supplying a crafted file. The vulnerability was published on June 25, 2026, and last modified on June 29, 2026. The Common Vulnerability Scoring System (CVSS) score is 5.5. This vulnerability is [truncated]
CVE-2025-60471 is a use-after-free vulnerability in the gf_filter_pid_reconfigure_task_discard function of GPAC Project/MP4Box before 26.02.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file. The vulnerability has a CVSS score of 5.5 and a severity of MEDIUM. The CVE was published on 2026-06-24T19:17:07.920Z and last modified on 2026-06-29T23:14:24 [truncated]
A stack overflow vulnerability was discovered in GPAC MP4Box v2.4, specifically in the gf_opus_read_length function located in media_tools/av_parsers.c. This vulnerability allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file. The vulnerability has a CVSS score of 5.5 and a severity rating of MEDIUM.
A heap buffer overflow vulnerability was discovered in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4. This vulnerability, tracked as CVE-2025-55652, allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file. The vulnerability has a CVSS score of 5.5 and a severity rating of MEDIUM.
CVE-2025-55650 is a medium-severity vulnerability in GPAC MP4Box v2.4. A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. The CVSS score for this vulnerability is 5.5.
CVE-2025-55649 is a medium-severity vulnerability in GPAC MP4Box v2.4. A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. The CVSS score for this vulnerability is 5.5.
A heap buffer overflow vulnerability was discovered in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4. This vulnerability, tracked as CVE-2025-55648, allows attackers to cause a Denial of Service (DoS) by supplying a crafted MP4 file. The vulnerability has a CVSS score of 5.5 and a severity rating of MEDIUM.
CVE-2025-55644 is a medium-severity vulnerability in GPAC MP4Box v2.4. A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. The CVSS score for this vulnerability is 5.5.
A NULL pointer dereference vulnerability in GPAC MP4Box v2.4 allows for Denial of Service (DoS) via a crafted MP4 file. Defenders should assess exposure, prioritize remediation, and verify vulnerability status. This vulnerability exists in the TrackWriter handling component (filters/mux_isom.c) and can be exploited by supplying a crafted MP4 file. Defenders responsible for GPAC MP4Box deployments should a [truncated]
A floating point exception vulnerability exists in GPAC MP4Box v2.4 in the avidmx_process function. This issue may impact multimedia processing systems that utilize GPAC's MP4Box tool. The vulnerability could potentially disrupt multimedia processing services and requires verification of affected GPAC MP4Box versions. Defenders should assess exposure, prioritize verification, and monitor for exploitation [truncated]
CVE-2025-55657 is a HIGH severity vulnerability in GPAC MP4Box v2.4. A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. The vulnerability has a CVSS score of 7.5 and was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2025-55657).
CVE-2025-55651 is a medium-severity vulnerability in GPAC MP4Box v2.4. A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. The vulnerability has a CVSS score of 5.5 and was published on [cvePublishedAt](https://www.cve.org/CVERecord?id=CVE-2025-55651).
A heap use-after-free vulnerability exists in the `dasher_process` function within `/filters/dasher.c` of GPAC Project/MP4Box before version 26.02.0. The flaw can be triggered when a crafted MPEG-2 file is processed, leading to a Denial of Service (DoS) condition. The vulnerability was addressed in a commit to the GPAC repository. A public issue report and proof-of-concept materials are available.
A heap buffer overflow vulnerability exists in the m2tsdmx_send_packet function within filters/dmx_m2ts.c in GPAC MP4Box v2.4. The flaw can be triggered when processing a crafted MP4 file, leading to a Denial of Service (DoS) condition. The vulnerability was addressed in a commit to the GPAC repository.
A NULL pointer dereference vulnerability exists in GPAC MP4Box when parsing malformed MP4 files. The issue occurs in `gf_media_map_esd` within the media tools ISOM utilities, where an unknown or invalid `stsd` (sample description) entry can result in missing descriptor fields—specifically codec, MIME type, or profile strings. When these fields are absent, the function subsequently calls `strlen()` on a NU [truncated]
A memory leak vulnerability exists in GPAC up to version 2.4.0, specifically within the Media_GetSample function in src/isomedia/media.c. The vulnerability is triggered through manipulation of the 'cat' argument when processing MP4 files via the MP4Box component. This issue results in memory leak (CWE-401/CWE-404) with availability impact. The attack vector is local, requiring low privileges but no user i [truncated]
A null pointer dereference vulnerability exists in GPAC up to version 2.4.0, specifically within the MergeFragment function in src/isomedia/isom_intern.c. The issue affects the MP4Box component and can be triggered through local manipulation. The vulnerability has been assigned a CVSS 4.0 score of 1.9 (LOW severity) with an attack vector of local access, low attack complexity, and low availability impact. [truncated]