# GPAC vulnerabilities Source: https://junglewise.ai/threats/technologies/gpac Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/gpac.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 52 vulnerabilities in GPAC: 2 in the last 7 days and 40 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124031, was published on 6 November 2026. 3 vulnerabilities in the last four weeks, down 88% on the four before (26). ## Counts - Last 7 days: 2 - Last 30 days: 2 - Last 90 days: 40 - All time: 52 (0 critical, 0 exploited in the wild) ## About GPAC Multimedia framework library for reading, building, and writing MPEG-4 media files and streams. ## Latest GPAC vulnerabilities - [CVE-2026-124031: GPAC type confusion in drawable_get_aspect_2d_mpeg4 and TraverseShape](https://junglewise.ai/threats/cve-2026-124031-gpac-through-26-07-0-contains-a-type-confusion-vulnerability-in) (medium, CVSS 5.5, published 6 Nov 2026) - [CVE-2026-124030: GPAC type confusion in gf_sg_command_apply](https://junglewise.ai/threats/cve-2026-124030-gpac-through-26-07-0-contains-a-type-confusion-vulnerability-in) (medium, CVSS 5.5, published 6 Nov 2026) - [CVE-2026-109827: GPAC out-of-bounds write in AIT parser](https://junglewise.ai/threats/cve-2026-109827-a-vulnerability-has-been-found-in-gpac-up-to-26-07-0-this) (medium, CVSS 6.3, published 13 Oct 2026) - [CVE-2026-108539: GPAC use after free in MP4Box filter queue](https://junglewise.ai/threats/cve-2026-108539-a-vulnerability-was-detected-in-gpac-up-to-26-07-0-this-affects) (medium, CVSS 6.3, published 11 Oct 2026) - [CVE-2026-103227: GPAC buffer overflow in DASH Client URL resolution](https://junglewise.ai/threats/cve-2026-103227-a-weakness-has-been-identified-in-gpac-up-to-26-07-0-affected-by) (medium, CVSS 6.3, published 30 Sep 2026) - [CVE-2026-93331: GPAC out-of-bounds read in RTP depacketizer](https://junglewise.ai/threats/cve-2026-93331-gpac-out-of-bounds-read-in-rtp-depacketizer) (high, CVSS 7.3, published 18 Sep 2026) - [CVE-2026-92475: GPAC out-of-bounds read in downloader Content-Range handling](https://junglewise.ai/threats/cve-2026-92475-gpac-out-of-bounds-read-in-downloader-content-range-handling) (medium, CVSS 5.3, published 16 Sep 2026) - [CVE-2026-92474: GPAC use-after-free in Proto Link Handler](https://junglewise.ai/threats/cve-2026-92474-gpac-use-after-free-in-proto-link-handler) (low, CVSS 3.3, published 16 Sep 2026) - [CVE-2026-92473: GPAC use after free in BIFS Handler](https://junglewise.ai/threats/cve-2026-92473-gpac-use-after-free-in-bifs-handler) (low, CVSS 3.3, published 16 Sep 2026) - [CVE-2026-92472: GPAC use-after-free in gf_node_deactivate_ex](https://junglewise.ai/threats/cve-2026-92472-gpac-use-after-free-in-gf-node-deactivate-ex) (low, CVSS 3.3, published 16 Sep 2026) - [CVE-2026-92399: GPAC heap-based buffer overflow in WebSocket handler](https://junglewise.ai/threats/cve-2026-92399-gpac-heap-based-buffer-overflow-in-websocket-handler) (high, CVSS 7.3, published 16 Sep 2026) - [CVE-2026-91091: GPAC memory corruption in node insertion](https://junglewise.ai/threats/cve-2026-91091-gpac-memory-corruption-in-node-insertion) (medium, CVSS 4.3, published 15 Sep 2026) - [CVE-2026-91090: GPAC stack-based buffer overflow in scenegraph base module](https://junglewise.ai/threats/cve-2026-91090-gpac-stack-based-buffer-overflow-in-scenegraph-base-module) (low, CVSS 3.9, published 15 Sep 2026) - [CVE-2026-91089: GPAC use after free in gf_node_get_name_and_id](https://junglewise.ai/threats/cve-2026-91089-gpac-use-after-free-in-gf-node-get-name-and-id) (medium, CVSS 6.3, published 15 Sep 2026) - [CVE-2026-91088: GPAC heap-based buffer overflow in URL handler](https://junglewise.ai/threats/cve-2026-91088-gpac-heap-based-buffer-overflow-in-url-handler) (medium, CVSS 4.8, published 15 Sep 2026) - [CVE-2026-91087: GPAC use-after-free in media object compositor](https://junglewise.ai/threats/cve-2026-91087-gpac-use-after-free-in-media-object-compositor) (high, CVSS 7.3, published 15 Sep 2026) - [CVE-2026-91086: GPAC heap-based buffer overflow in MPEG Video Reframer](https://junglewise.ai/threats/cve-2026-91086-gpac-heap-based-buffer-overflow-in-mpeg-video-reframer) (medium, CVSS 6.3, published 15 Sep 2026) - [CVE-2026-90825: GPAC MP4Box use-after-free in gf_node_unregister](https://junglewise.ai/threats/cve-2026-90825-gpac-mp4box-use-after-free-in-gf-node-unregister) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90824: GPAC stack-based buffer overflow in DOM event handling](https://junglewise.ai/threats/cve-2026-90824-gpac-stack-based-buffer-overflow-in-dom-event-handling) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90793: GPAC MP4Box heap use-after-free in gf_node_get_name](https://junglewise.ai/threats/cve-2026-90793-gpac-mp4box-heap-use-after-free-in-gf-node-get-name) (medium, CVSS 5.4, published 14 Sep 2026) - [CVE-2026-90792: GPAC MP4Box null pointer dereference in gf_node_list_get_child](https://junglewise.ai/threats/cve-2026-90792-gpac-mp4box-null-pointer-dereference-in-gf-node-list-get-child) (medium, CVSS 4.3, published 14 Sep 2026) - [CVE-2026-90687: GPAC MP4Box use-after-free in gf_node_changed_internal](https://junglewise.ai/threats/cve-2026-90687-gpac-mp4box-use-after-free-in-gf-node-changed-internal) (medium, CVSS 6.3, published 14 Sep 2026) - [CVE-2026-90685: GPAC MP4Box reachable assertion in LSR command processing](https://junglewise.ai/threats/cve-2026-90685-gpac-mp4box-reachable-assertion-in-lsr-command-processing) (low, CVSS 2.8, published 14 Sep 2026) - [CVE-2026-90684: GPAC MP4Box reachable assertion in gf_node_get_field_count](https://junglewise.ai/threats/cve-2026-90684-gpac-mp4box-reachable-assertion-in-gf-node-get-field-count) (low, CVSS 2.8, published 14 Sep 2026) - [CVE-2026-90683: GPAC gf_node_unregister reachable assertion in MP4Box](https://junglewise.ai/threats/cve-2026-90683-gpac-gf-node-unregister-reachable-assertion-in-mp4box) (low, CVSS 3.3, published 14 Sep 2026) ## Most severe GPAC vulnerabilities - [CVE-2026-71614: GPAC integer underflow in dvb_mpe.c](https://junglewise.ai/threats/cve-2026-71614-gpac-integer-underflow-in-dvb-mpe-c) (high, CVSS 8.4, published 9 Sep 2026) - [CVE-2026-71612: GPAC buffer overflow in nhntdmx_process via long file path](https://junglewise.ai/threats/cve-2026-71612-gpac-buffer-overflow-in-nhntdmx-process-via-long-file-path) (high, CVSS 8.4, published 9 Sep 2026) - [CVE-2026-71613: GPAC buffer overflow in j2kdec_process JP2 decoder](https://junglewise.ai/threats/cve-2026-71613-gpac-buffer-overflow-in-j2kdec-process-jp2-decoder) (high, CVSS 7.8, published 9 Sep 2026) - [CVE-2026-52489: GPAC buffer overflow in SVG name handling](https://junglewise.ai/threats/cve-2026-52489-gpac-buffer-overflow-in-svg-name-handling) (high, CVSS 7.8, published 25 Aug 2026) - [CVE-2026-92399: GPAC heap-based buffer overflow in WebSocket handler](https://junglewise.ai/threats/cve-2026-92399-gpac-heap-based-buffer-overflow-in-websocket-handler) (high, CVSS 7.3, published 16 Sep 2026) - [CVE-2026-91087: GPAC use-after-free in media object compositor](https://junglewise.ai/threats/cve-2026-91087-gpac-use-after-free-in-media-object-compositor) (high, CVSS 7.3, published 15 Sep 2026) - [CVE-2026-93331: GPAC out-of-bounds read in RTP depacketizer](https://junglewise.ai/threats/cve-2026-93331-gpac-out-of-bounds-read-in-rtp-depacketizer) (high, CVSS 7.3, published 18 Sep 2026) - [CVE-2026-79522: GPAC out-of-bounds read in downloader HTTP client](https://junglewise.ai/threats/cve-2026-79522-gpac-out-of-bounds-read-in-downloader-http-client) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-79514: GPAC out-of-bounds read in downloader via chunked HTTP response](https://junglewise.ai/threats/cve-2026-79514-gpac-out-of-bounds-read-in-downloader-via-chunked-http-response) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-79513: GPAC divide-by-zero in dash_client timeline parsing](https://junglewise.ai/threats/cve-2026-79513-gpac-divide-by-zero-in-dash-client-timeline-parsing) (medium, CVSS 6.5, published 9 Sep 2026) ## Vulnerabilities per week 3 vulnerabilities in the last four weeks, down 88% on the four before (26). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 10 | 0 | 0 | | 14 Sep 2026 | 24 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Gpac technologies - [Gpac MP4Box](https://junglewise.ai/threats/technologies/mp4box): 32 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "GPAC vulnerabilities", https://junglewise.ai/threats/technologies/gpac, 13 November 2026.