{"schema_version":1,"title":"Gpac MP4Box vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 28 vulnerabilities in Gpac MP4Box: 0 in the last 7 days and 7 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90827, was published on 14 September 2026.","url":"https://junglewise.ai/threats/technologies/mp4box","json_url":"https://junglewise.ai/threats/technologies/mp4box.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/mp4box","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":0,"all_time":28,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":7,"last_90_days":7,"last_365_days":28},"latest":[{"cve":"CVE-2026-90827","cvss":3.3,"epss":0.0017,"slug":"cve-2026-90827-gpac-mp4box-use-after-free-in-gf-node-deactivate-ex","title":"GPAC MP4Box use-after-free in gf_node_deactivate_ex","severity":"low","exploited":false,"published_at":"2026-09-14T22:16:58.503+00:00","url":"https://junglewise.ai/threats/cve-2026-90827-gpac-mp4box-use-after-free-in-gf-node-deactivate-ex"},{"cve":"CVE-2026-90826","cvss":2.8,"epss":0.0016,"slug":"cve-2026-90826-gpac-mp4box-out-of-bounds-read-in-gf-node-del","title":"GPAC MP4Box out-of-bounds read in gf_node_del","severity":"low","exploited":false,"published_at":"2026-09-14T22:16:58.303+00:00","url":"https://junglewise.ai/threats/cve-2026-90826-gpac-mp4box-out-of-bounds-read-in-gf-node-del"},{"cve":"CVE-2026-90794","cvss":6.3,"epss":0.0051,"slug":"cve-2026-90794-gpac-mp4box-use-after-free-in-gf-sg-script-load","title":"GPAC MP4Box use-after-free in gf_sg_script_load","severity":"medium","exploited":false,"published_at":"2026-09-14T16:17:41.29+00:00","url":"https://junglewise.ai/threats/cve-2026-90794-gpac-mp4box-use-after-free-in-gf-sg-script-load"},{"cve":"CVE-2026-90791","cvss":6.3,"epss":0.0051,"slug":"cve-2026-90791-gpac-mp4box-use-after-free-in-gf-node-unregister","title":"GPAC MP4Box use-after-free in gf_node_unregister","severity":"medium","exploited":false,"published_at":"2026-09-14T15:17:13.417+00:00","url":"https://junglewise.ai/threats/cve-2026-90791-gpac-mp4box-use-after-free-in-gf-node-unregister"},{"cve":"CVE-2026-90686","cvss":5.3,"epss":0.0086,"slug":"cve-2026-90686-gpac-mp4box-invalid-read-in-gf-bt-report-function","title":"GPAC MP4Box invalid read in gf_bt_report function","severity":"medium","exploited":false,"published_at":"2026-09-14T06:16:58.507+00:00","url":"https://junglewise.ai/threats/cve-2026-90686-gpac-mp4box-invalid-read-in-gf-bt-report-function"},{"cve":"CVE-2026-90611","cvss":3.3,"epss":0.0017,"slug":"cve-2026-90611-gpac-mp4box-reachable-assertion-in-xmt-parsing","title":"GPAC MP4Box reachable assertion in XMT parsing","severity":"low","exploited":false,"published_at":"2026-09-14T02:17:15.357+00:00","url":"https://junglewise.ai/threats/cve-2026-90611-gpac-mp4box-reachable-assertion-in-xmt-parsing"},{"cve":"CVE-2026-90578","cvss":5.3,"epss":0.0017,"slug":"cve-2026-90578-gpac-mp4box-use-after-free-in-gf-list-count","title":"GPAC MP4Box use-after-free in gf_list_count","severity":"medium","exploited":false,"published_at":"2026-09-13T19:16:53.35+00:00","url":"https://junglewise.ai/threats/cve-2026-90578-gpac-mp4box-use-after-free-in-gf-list-count"},{"cve":"CVE-2025-55639","cvss":5.5,"slug":"cve-2025-55639-gpac-mp4box-null-pointer-dereference-in-gf-isom-add-track-kind","title":"GPAC MP4Box NULL pointer dereference in gf_isom_add_track_kind","severity":"info","exploited":false,"published_at":"2026-06-23T16:16:58.52+00:00","url":"https://junglewise.ai/threats/cve-2025-55639-gpac-mp4box-null-pointer-dereference-in-gf-isom-add-track-kind"},{"cve":"CVE-2025-55663","slug":"cve-2025-55663-gpac-mp4box-segmentation-violation-in-track-setstreamdescriptor","title":"GPAC MP4Box segmentation violation in Track_SetStreamDescriptor","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:24.477+00:00","url":"https://junglewise.ai/threats/cve-2025-55663-gpac-mp4box-segmentation-violation-in-track-setstreamdescriptor"},{"cve":"CVE-2025-55661","cvss":0,"slug":"cve-2025-55661-gpac-mp4box-heap-buffer-overflow-in-opus-audio-stream-parser","title":"GPAC MP4Box heap buffer overflow in Opus audio stream parser","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:24.36+00:00","url":"https://junglewise.ai/threats/cve-2025-55661-gpac-mp4box-heap-buffer-overflow-in-opus-audio-stream-parser"},{"cve":"CVE-2025-55660","slug":"cve-2025-55660-gpac-mp4box-stack-overflow-in-gf-opus-read-length","title":"GPAC MP4Box stack overflow in gf_opus_read_length","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:24.25+00:00","url":"https://junglewise.ai/threats/cve-2025-55660-gpac-mp4box-stack-overflow-in-gf-opus-read-length"},{"cve":"CVE-2025-55652","slug":"cve-2025-55652-gpac-mp4box-heap-buffer-overflow-in-gf-isom-vp-config-new","title":"GPAC MP4Box heap buffer overflow in gf_isom_vp_config_new","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:24.137+00:00","url":"https://junglewise.ai/threats/cve-2025-55652-gpac-mp4box-heap-buffer-overflow-in-gf-isom-vp-config-new"},{"cve":"CVE-2025-55650","slug":"cve-2025-55650-gpac-mp4box-heap-use-after-free-in-gf-node-get-tag","title":"GPAC MP4Box heap use-after-free in gf_node_get_tag","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:24.03+00:00","url":"https://junglewise.ai/threats/cve-2025-55650-gpac-mp4box-heap-use-after-free-in-gf-node-get-tag"},{"cve":"CVE-2025-55649","cvss":5.5,"slug":"cve-2025-55649-gpac-mp4box-null-pointer-dereference-in-gf-media-map-esd","title":"GPAC MP4Box NULL pointer dereference in gf_media_map_esd","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.923+00:00","url":"https://junglewise.ai/threats/cve-2025-55649-gpac-mp4box-null-pointer-dereference-in-gf-media-map-esd"},{"cve":"CVE-2025-55648","slug":"cve-2025-55648-gpac-mp4box-heap-buffer-overflow-in-gf-opus-parse-packet-header","title":"GPAC MP4Box heap buffer overflow in gf_opus_parse_packet_header","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.817+00:00","url":"https://junglewise.ai/threats/cve-2025-55648-gpac-mp4box-heap-buffer-overflow-in-gf-opus-parse-packet-header"},{"cve":"CVE-2025-55647","cvss":5.5,"slug":"cve-2025-55647-gpac-mp4box-out-of-memory-in-mp4-mux-cenc-insert-pssh","title":"GPAC MP4Box Out-of-Memory in mp4_mux_cenc_insert_pssh","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.71+00:00","url":"https://junglewise.ai/threats/cve-2025-55647-gpac-mp4box-out-of-memory-in-mp4-mux-cenc-insert-pssh"},{"cve":"CVE-2025-55645","slug":"cve-2025-55645-gpac-mp4box-heap-buffer-overflow-in-gf-cenc-set-pssh","title":"GPAC MP4Box heap buffer overflow in gf_cenc_set_pssh","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.6+00:00","url":"https://junglewise.ai/threats/cve-2025-55645-gpac-mp4box-heap-buffer-overflow-in-gf-cenc-set-pssh"},{"cve":"CVE-2025-55644","slug":"cve-2025-55644-gpac-mp4box-heap-use-after-free-in-gf-node-get-tag","title":"GPAC MP4Box heap use-after-free in gf_node_get_tag","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.49+00:00","url":"https://junglewise.ai/threats/cve-2025-55644-gpac-mp4box-heap-use-after-free-in-gf-node-get-tag"},{"cve":"CVE-2025-55643","cvss":5.5,"slug":"cve-2025-55643-gpac-mp4box-null-pointer-dereference-in-trackwriter","title":"GPAC MP4Box NULL pointer dereference in TrackWriter","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.38+00:00","url":"https://junglewise.ai/threats/cve-2025-55643-gpac-mp4box-null-pointer-dereference-in-trackwriter"},{"cve":"CVE-2025-55642","slug":"cve-2025-55642-gpac-mp4box-floating-point-exception-in-avidmx-process","title":"GPAC MP4Box floating point exception in avidmx_process","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.257+00:00","url":"https://junglewise.ai/threats/cve-2025-55642-gpac-mp4box-floating-point-exception-in-avidmx-process"},{"cve":"CVE-2025-55641","slug":"cve-2025-55641-gpac-mp4box-null-pointer-dereference-in-gf-isom-copy-sample-info","title":"GPAC MP4Box NULL pointer dereference in gf_isom_copy_sample_info","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:22.687+00:00","url":"https://junglewise.ai/threats/cve-2025-55641-gpac-mp4box-null-pointer-dereference-in-gf-isom-copy-sample-info"},{"cve":"CVE-2025-55659","cvss":5.5,"slug":"cve-2025-55659-gpac-mp4box-null-pointer-dereference-in-ctts-box-write","title":"GPAC MP4Box NULL pointer dereference in ctts_box_write","severity":"info","exploited":false,"published_at":"2026-06-09T19:17:31.64+00:00","url":"https://junglewise.ai/threats/cve-2025-55659-gpac-mp4box-null-pointer-dereference-in-ctts-box-write"},{"cve":"CVE-2025-55658","cvss":5.5,"slug":"cve-2025-55658-gpac-mp4box-floating-point-exception-in-gf-opus-parse-packet","title":"GPAC MP4Box floating point exception in gf_opus_parse_packet_header","severity":"info","exploited":false,"published_at":"2026-06-09T19:17:31.527+00:00","url":"https://junglewise.ai/threats/cve-2025-55658-gpac-mp4box-floating-point-exception-in-gf-opus-parse-packet"},{"cve":"CVE-2025-55657","slug":"cve-2025-55657-gpac-mp4box-null-pointer-dereference-in-gf-odf-vvc-cfg-write-bs","title":"GPAC MP4Box NULL pointer dereference in gf_odf_vvc_cfg_write_bs","severity":"info","exploited":false,"published_at":"2026-06-09T19:17:31.41+00:00","url":"https://junglewise.ai/threats/cve-2025-55657-gpac-mp4box-null-pointer-dereference-in-gf-odf-vvc-cfg-write-bs"},{"cve":"CVE-2025-55651","slug":"cve-2025-55651-gpac-mp4box-null-pointer-dereference-in-gf-isom-get-user-data","title":"GPAC MP4Box NULL pointer dereference in gf_isom_get_user_data_count","severity":"info","exploited":false,"published_at":"2026-06-09T19:17:31.29+00:00","url":"https://junglewise.ai/threats/cve-2025-55651-gpac-mp4box-null-pointer-dereference-in-gf-isom-get-user-data"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"GPAC","slug":"gpac","vulnerabilities":47,"url":"https://junglewise.ai/threats/technologies/gpac"}],"technology":{"hub":true,"name":"Gpac MP4Box","slug":"mp4box","vendor":{"name":"Gpac","slug":"gpac","url":"https://junglewise.ai/threats/vendors/gpac"},"aliases":[],"category":"library","homepage":"https://gpac.io/","repo_url":"https://github.com/gpac/gpac","description":"MP4Box is a multimedia packager and command-line tool for the GPAC framework used for manipulating MPEG-4 files.","url":"https://junglewise.ai/threats/technologies/mp4box"},"most_severe":[{"cve":"CVE-2026-90794","cvss":6.3,"epss":0.0051,"slug":"cve-2026-90794-gpac-mp4box-use-after-free-in-gf-sg-script-load","title":"GPAC MP4Box use-after-free in gf_sg_script_load","severity":"medium","exploited":false,"published_at":"2026-09-14T16:17:41.29+00:00","url":"https://junglewise.ai/threats/cve-2026-90794-gpac-mp4box-use-after-free-in-gf-sg-script-load"},{"cve":"CVE-2026-90791","cvss":6.3,"epss":0.0051,"slug":"cve-2026-90791-gpac-mp4box-use-after-free-in-gf-node-unregister","title":"GPAC MP4Box use-after-free in gf_node_unregister","severity":"medium","exploited":false,"published_at":"2026-09-14T15:17:13.417+00:00","url":"https://junglewise.ai/threats/cve-2026-90791-gpac-mp4box-use-after-free-in-gf-node-unregister"},{"cve":"CVE-2026-90686","cvss":5.3,"epss":0.0086,"slug":"cve-2026-90686-gpac-mp4box-invalid-read-in-gf-bt-report-function","title":"GPAC MP4Box invalid read in gf_bt_report function","severity":"medium","exploited":false,"published_at":"2026-09-14T06:16:58.507+00:00","url":"https://junglewise.ai/threats/cve-2026-90686-gpac-mp4box-invalid-read-in-gf-bt-report-function"},{"cve":"CVE-2026-90578","cvss":5.3,"epss":0.0017,"slug":"cve-2026-90578-gpac-mp4box-use-after-free-in-gf-list-count","title":"GPAC MP4Box use-after-free in gf_list_count","severity":"medium","exploited":false,"published_at":"2026-09-13T19:16:53.35+00:00","url":"https://junglewise.ai/threats/cve-2026-90578-gpac-mp4box-use-after-free-in-gf-list-count"},{"cve":"CVE-2026-90827","cvss":3.3,"epss":0.0017,"slug":"cve-2026-90827-gpac-mp4box-use-after-free-in-gf-node-deactivate-ex","title":"GPAC MP4Box use-after-free in gf_node_deactivate_ex","severity":"low","exploited":false,"published_at":"2026-09-14T22:16:58.503+00:00","url":"https://junglewise.ai/threats/cve-2026-90827-gpac-mp4box-use-after-free-in-gf-node-deactivate-ex"},{"cve":"CVE-2026-90611","cvss":3.3,"epss":0.0017,"slug":"cve-2026-90611-gpac-mp4box-reachable-assertion-in-xmt-parsing","title":"GPAC MP4Box reachable assertion in XMT parsing","severity":"low","exploited":false,"published_at":"2026-09-14T02:17:15.357+00:00","url":"https://junglewise.ai/threats/cve-2026-90611-gpac-mp4box-reachable-assertion-in-xmt-parsing"},{"cve":"CVE-2026-90826","cvss":2.8,"epss":0.0016,"slug":"cve-2026-90826-gpac-mp4box-out-of-bounds-read-in-gf-node-del","title":"GPAC MP4Box out-of-bounds read in gf_node_del","severity":"low","exploited":false,"published_at":"2026-09-14T22:16:58.303+00:00","url":"https://junglewise.ai/threats/cve-2026-90826-gpac-mp4box-out-of-bounds-read-in-gf-node-del"},{"cve":"CVE-2025-55639","cvss":5.5,"slug":"cve-2025-55639-gpac-mp4box-null-pointer-dereference-in-gf-isom-add-track-kind","title":"GPAC MP4Box NULL pointer dereference in gf_isom_add_track_kind","severity":"info","exploited":false,"published_at":"2026-06-23T16:16:58.52+00:00","url":"https://junglewise.ai/threats/cve-2025-55639-gpac-mp4box-null-pointer-dereference-in-gf-isom-add-track-kind"},{"cve":"CVE-2025-55649","cvss":5.5,"slug":"cve-2025-55649-gpac-mp4box-null-pointer-dereference-in-gf-media-map-esd","title":"GPAC MP4Box NULL pointer dereference in gf_media_map_esd","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.923+00:00","url":"https://junglewise.ai/threats/cve-2025-55649-gpac-mp4box-null-pointer-dereference-in-gf-media-map-esd"},{"cve":"CVE-2025-55647","cvss":5.5,"slug":"cve-2025-55647-gpac-mp4box-out-of-memory-in-mp4-mux-cenc-insert-pssh","title":"GPAC MP4Box Out-of-Memory in mp4_mux_cenc_insert_pssh","severity":"info","exploited":false,"published_at":"2026-06-15T20:16:23.71+00:00","url":"https://junglewise.ai/threats/cve-2025-55647-gpac-mp4box-out-of-memory-in-mp4-mux-cenc-insert-pssh"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}