# Gpac MP4Box vulnerabilities Source: https://junglewise.ai/threats/technologies/mp4box Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/mp4box.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 32 vulnerabilities in Gpac MP4Box: 0 in the last 7 days and 11 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2025-55667, was published on 19 October 2026. 4 vulnerabilities in the last four weeks, down 33% on the four before (6). ## Counts - Last 7 days: 0 - Last 30 days: 4 - Last 90 days: 11 - All time: 32 (0 critical, 0 exploited in the wild) ## About Gpac MP4Box MP4Box is a multimedia packager and command-line tool for the GPAC framework used for manipulating MPEG-4 files. ## Latest Gpac MP4Box vulnerabilities - [CVE-2025-55667: GPAC MP4Box segmentation fault in dump_isom_saps](https://junglewise.ai/threats/cve-2025-55667-a-segmentation-violation-in-the-dump-isom-saps-function-mp4box) (info, published 19 Oct 2026) - [CVE-2025-55654: GPAC MP4Box use-after-free in gf_filter_pid_get_packet](https://junglewise.ai/threats/cve-2025-55654-a-use-after-free-in-the-gf-filter-pid-get-packet-function-filter) (info, published 19 Oct 2026) - [CVE-2025-55653: GPAC MP4Box floating point exception in gf_parse_lfrac](https://junglewise.ai/threats/cve-2025-55653-gpac-mp4box-v2-4-was-discovered-to-contain-a-floating-point) (info, published 16 Oct 2026) - [CVE-2025-55640: GPAC MP4Box heap buffer overflow in stbl_AddSize](https://junglewise.ai/threats/cve-2025-55640-a-heap-buffer-overflow-in-the-stbl-addsize-function-isomedia-stbl) (info, published 16 Oct 2026) - [CVE-2026-90827: GPAC MP4Box use-after-free in gf_node_deactivate_ex](https://junglewise.ai/threats/cve-2026-90827-gpac-mp4box-use-after-free-in-gf-node-deactivate-ex) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90826: GPAC MP4Box out-of-bounds read in gf_node_del](https://junglewise.ai/threats/cve-2026-90826-gpac-mp4box-out-of-bounds-read-in-gf-node-del) (low, CVSS 2.8, published 14 Sep 2026) - [CVE-2026-90794: GPAC MP4Box use-after-free in gf_sg_script_load](https://junglewise.ai/threats/cve-2026-90794-gpac-mp4box-use-after-free-in-gf-sg-script-load) (medium, CVSS 6.3, published 14 Sep 2026) - [CVE-2026-90791: GPAC MP4Box use-after-free in gf_node_unregister](https://junglewise.ai/threats/cve-2026-90791-gpac-mp4box-use-after-free-in-gf-node-unregister) (medium, CVSS 6.3, published 14 Sep 2026) - [CVE-2026-90686: GPAC MP4Box invalid read in gf_bt_report function](https://junglewise.ai/threats/cve-2026-90686-gpac-mp4box-invalid-read-in-gf-bt-report-function) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-90611: GPAC MP4Box reachable assertion in XMT parsing](https://junglewise.ai/threats/cve-2026-90611-gpac-mp4box-reachable-assertion-in-xmt-parsing) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90578: GPAC MP4Box use-after-free in gf_list_count](https://junglewise.ai/threats/cve-2026-90578-gpac-mp4box-use-after-free-in-gf-list-count) (medium, CVSS 5.3, published 13 Sep 2026) - [CVE-2025-55639: GPAC MP4Box NULL pointer dereference in gf_isom_add_track_kind](https://junglewise.ai/threats/cve-2025-55639-gpac-mp4box-null-pointer-dereference-in-gf-isom-add-track-kind) (info, CVSS 5.5, published 23 Jun 2026) - [CVE-2025-55663: GPAC MP4Box segmentation violation in Track_SetStreamDescriptor](https://junglewise.ai/threats/cve-2025-55663-gpac-mp4box-segmentation-violation-in-track-setstreamdescriptor) (info, published 15 Jun 2026) - [CVE-2025-55661: GPAC MP4Box heap buffer overflow in Opus audio stream parser](https://junglewise.ai/threats/cve-2025-55661-gpac-mp4box-heap-buffer-overflow-in-opus-audio-stream-parser) (info, CVSS 0, published 15 Jun 2026) - [CVE-2025-55660: GPAC MP4Box stack overflow in gf_opus_read_length](https://junglewise.ai/threats/cve-2025-55660-gpac-mp4box-stack-overflow-in-gf-opus-read-length) (info, published 15 Jun 2026) - [CVE-2025-55652: GPAC MP4Box heap buffer overflow in gf_isom_vp_config_new](https://junglewise.ai/threats/cve-2025-55652-gpac-mp4box-heap-buffer-overflow-in-gf-isom-vp-config-new) (info, published 15 Jun 2026) - [CVE-2025-55650: GPAC MP4Box heap use-after-free in gf_node_get_tag](https://junglewise.ai/threats/cve-2025-55650-gpac-mp4box-heap-use-after-free-in-gf-node-get-tag) (info, published 15 Jun 2026) - [CVE-2025-55649: GPAC MP4Box NULL pointer dereference in gf_media_map_esd](https://junglewise.ai/threats/cve-2025-55649-gpac-mp4box-null-pointer-dereference-in-gf-media-map-esd) (info, CVSS 5.5, published 15 Jun 2026) - [CVE-2025-55648: GPAC MP4Box heap buffer overflow in gf_opus_parse_packet_header](https://junglewise.ai/threats/cve-2025-55648-gpac-mp4box-heap-buffer-overflow-in-gf-opus-parse-packet-header) (info, published 15 Jun 2026) - [CVE-2025-55647: GPAC MP4Box Out-of-Memory in mp4_mux_cenc_insert_pssh](https://junglewise.ai/threats/cve-2025-55647-gpac-mp4box-out-of-memory-in-mp4-mux-cenc-insert-pssh) (info, CVSS 5.5, published 15 Jun 2026) - [CVE-2025-55645: GPAC MP4Box heap buffer overflow in gf_cenc_set_pssh](https://junglewise.ai/threats/cve-2025-55645-gpac-mp4box-heap-buffer-overflow-in-gf-cenc-set-pssh) (info, published 15 Jun 2026) - [CVE-2025-55644: GPAC MP4Box heap use-after-free in gf_node_get_tag](https://junglewise.ai/threats/cve-2025-55644-gpac-mp4box-heap-use-after-free-in-gf-node-get-tag) (info, published 15 Jun 2026) - [CVE-2025-55643: GPAC MP4Box NULL pointer dereference in TrackWriter](https://junglewise.ai/threats/cve-2025-55643-gpac-mp4box-null-pointer-dereference-in-trackwriter) (info, CVSS 5.5, published 15 Jun 2026) - [CVE-2025-55642: GPAC MP4Box floating point exception in avidmx_process](https://junglewise.ai/threats/cve-2025-55642-gpac-mp4box-floating-point-exception-in-avidmx-process) (info, published 15 Jun 2026) - [CVE-2025-55641: GPAC MP4Box NULL pointer dereference in gf_isom_copy_sample_info](https://junglewise.ai/threats/cve-2025-55641-gpac-mp4box-null-pointer-dereference-in-gf-isom-copy-sample-info) (info, published 15 Jun 2026) ## Most severe Gpac MP4Box vulnerabilities - [CVE-2026-90794: GPAC MP4Box use-after-free in gf_sg_script_load](https://junglewise.ai/threats/cve-2026-90794-gpac-mp4box-use-after-free-in-gf-sg-script-load) (medium, CVSS 6.3, published 14 Sep 2026) - [CVE-2026-90791: GPAC MP4Box use-after-free in gf_node_unregister](https://junglewise.ai/threats/cve-2026-90791-gpac-mp4box-use-after-free-in-gf-node-unregister) (medium, CVSS 6.3, published 14 Sep 2026) - [CVE-2026-90686: GPAC MP4Box invalid read in gf_bt_report function](https://junglewise.ai/threats/cve-2026-90686-gpac-mp4box-invalid-read-in-gf-bt-report-function) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-90578: GPAC MP4Box use-after-free in gf_list_count](https://junglewise.ai/threats/cve-2026-90578-gpac-mp4box-use-after-free-in-gf-list-count) (medium, CVSS 5.3, published 13 Sep 2026) - [CVE-2026-90827: GPAC MP4Box use-after-free in gf_node_deactivate_ex](https://junglewise.ai/threats/cve-2026-90827-gpac-mp4box-use-after-free-in-gf-node-deactivate-ex) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90611: GPAC MP4Box reachable assertion in XMT parsing](https://junglewise.ai/threats/cve-2026-90611-gpac-mp4box-reachable-assertion-in-xmt-parsing) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90826: GPAC MP4Box out-of-bounds read in gf_node_del](https://junglewise.ai/threats/cve-2026-90826-gpac-mp4box-out-of-bounds-read-in-gf-node-del) (low, CVSS 2.8, published 14 Sep 2026) - [CVE-2025-55639: GPAC MP4Box NULL pointer dereference in gf_isom_add_track_kind](https://junglewise.ai/threats/cve-2025-55639-gpac-mp4box-null-pointer-dereference-in-gf-isom-add-track-kind) (info, CVSS 5.5, published 23 Jun 2026) - [CVE-2025-55649: GPAC MP4Box NULL pointer dereference in gf_media_map_esd](https://junglewise.ai/threats/cve-2025-55649-gpac-mp4box-null-pointer-dereference-in-gf-media-map-esd) (info, CVSS 5.5, published 15 Jun 2026) - [CVE-2025-55647: GPAC MP4Box Out-of-Memory in mp4_mux_cenc_insert_pssh](https://junglewise.ai/threats/cve-2025-55647-gpac-mp4box-out-of-memory-in-mp4-mux-cenc-insert-pssh) (info, CVSS 5.5, published 15 Jun 2026) ## Vulnerabilities per week 4 vulnerabilities in the last four weeks, down 33% on the four before (6). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 6 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 2 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Gpac technologies - [GPAC](https://junglewise.ai/threats/technologies/gpac): 52 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Gpac MP4Box vulnerabilities", https://junglewise.ai/threats/technologies/mp4box, 9 November 2026.