# Gpac vulnerabilities Source: https://junglewise.ai/threats/vendors/gpac Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/gpac.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 80 vulnerabilities in Gpac: 2 in the last 7 days and 47 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-124031, was published on 6 November 2026. 7 vulnerabilities in the last four weeks, down 75% on the four before (28). 2 technologies have a page of their own. ## Counts - Last 7 days: 2 - Last 30 days: 6 - Last 90 days: 47 - All time: 80 (0 critical, 0 exploited in the wild) ## About Gpac Organization that develops and maintains the GPAC multimedia framework and tools. ## Latest Gpac vulnerabilities - [CVE-2026-124031: GPAC type confusion in drawable_get_aspect_2d_mpeg4 and TraverseShape](https://junglewise.ai/threats/cve-2026-124031-gpac-through-26-07-0-contains-a-type-confusion-vulnerability-in) (medium, CVSS 5.5, published 6 Nov 2026) - [CVE-2026-124030: GPAC type confusion in gf_sg_command_apply](https://junglewise.ai/threats/cve-2026-124030-gpac-through-26-07-0-contains-a-type-confusion-vulnerability-in) (medium, CVSS 5.5, published 6 Nov 2026) - [CVE-2025-55667: GPAC MP4Box segmentation fault in dump_isom_saps](https://junglewise.ai/threats/cve-2025-55667-a-segmentation-violation-in-the-dump-isom-saps-function-mp4box) (info, published 19 Oct 2026) - [CVE-2025-55654: GPAC MP4Box use-after-free in gf_filter_pid_get_packet](https://junglewise.ai/threats/cve-2025-55654-a-use-after-free-in-the-gf-filter-pid-get-packet-function-filter) (info, published 19 Oct 2026) - [CVE-2025-55653: GPAC MP4Box floating point exception in gf_parse_lfrac](https://junglewise.ai/threats/cve-2025-55653-gpac-mp4box-v2-4-was-discovered-to-contain-a-floating-point) (info, published 16 Oct 2026) - [CVE-2025-55640: GPAC MP4Box heap buffer overflow in stbl_AddSize](https://junglewise.ai/threats/cve-2025-55640-a-heap-buffer-overflow-in-the-stbl-addsize-function-isomedia-stbl) (info, published 16 Oct 2026) - [CVE-2026-109827: GPAC out-of-bounds write in AIT parser](https://junglewise.ai/threats/cve-2026-109827-a-vulnerability-has-been-found-in-gpac-up-to-26-07-0-this) (medium, CVSS 6.3, published 13 Oct 2026) - [CVE-2026-108539: GPAC use after free in MP4Box filter queue](https://junglewise.ai/threats/cve-2026-108539-a-vulnerability-was-detected-in-gpac-up-to-26-07-0-this-affects) (medium, CVSS 6.3, published 11 Oct 2026) - [CVE-2026-103227: GPAC buffer overflow in DASH Client URL resolution](https://junglewise.ai/threats/cve-2026-103227-a-weakness-has-been-identified-in-gpac-up-to-26-07-0-affected-by) (medium, CVSS 6.3, published 30 Sep 2026) - [CVE-2026-93331: GPAC out-of-bounds read in RTP depacketizer](https://junglewise.ai/threats/cve-2026-93331-gpac-out-of-bounds-read-in-rtp-depacketizer) (high, CVSS 7.3, published 18 Sep 2026) - [CVE-2026-92475: GPAC out-of-bounds read in downloader Content-Range handling](https://junglewise.ai/threats/cve-2026-92475-gpac-out-of-bounds-read-in-downloader-content-range-handling) (medium, CVSS 5.3, published 16 Sep 2026) - [CVE-2026-92474: GPAC use-after-free in Proto Link Handler](https://junglewise.ai/threats/cve-2026-92474-gpac-use-after-free-in-proto-link-handler) (low, CVSS 3.3, published 16 Sep 2026) - [CVE-2026-92399: GPAC heap-based buffer overflow in WebSocket handler](https://junglewise.ai/threats/cve-2026-92399-gpac-heap-based-buffer-overflow-in-websocket-handler) (high, CVSS 7.3, published 16 Sep 2026) - [CVE-2026-91091: GPAC memory corruption in node insertion](https://junglewise.ai/threats/cve-2026-91091-gpac-memory-corruption-in-node-insertion) (medium, CVSS 4.3, published 15 Sep 2026) - [CVE-2026-91090: GPAC stack-based buffer overflow in scenegraph base module](https://junglewise.ai/threats/cve-2026-91090-gpac-stack-based-buffer-overflow-in-scenegraph-base-module) (low, CVSS 3.9, published 15 Sep 2026) - [CVE-2026-91089: GPAC use after free in gf_node_get_name_and_id](https://junglewise.ai/threats/cve-2026-91089-gpac-use-after-free-in-gf-node-get-name-and-id) (medium, CVSS 6.3, published 15 Sep 2026) - [CVE-2026-91088: GPAC heap-based buffer overflow in URL handler](https://junglewise.ai/threats/cve-2026-91088-gpac-heap-based-buffer-overflow-in-url-handler) (medium, CVSS 4.8, published 15 Sep 2026) - [CVE-2026-90827: GPAC MP4Box use-after-free in gf_node_deactivate_ex](https://junglewise.ai/threats/cve-2026-90827-gpac-mp4box-use-after-free-in-gf-node-deactivate-ex) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90826: GPAC MP4Box out-of-bounds read in gf_node_del](https://junglewise.ai/threats/cve-2026-90826-gpac-mp4box-out-of-bounds-read-in-gf-node-del) (low, CVSS 2.8, published 14 Sep 2026) - [CVE-2026-90825: GPAC MP4Box use-after-free in gf_node_unregister](https://junglewise.ai/threats/cve-2026-90825-gpac-mp4box-use-after-free-in-gf-node-unregister) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90824: GPAC stack-based buffer overflow in DOM event handling](https://junglewise.ai/threats/cve-2026-90824-gpac-stack-based-buffer-overflow-in-dom-event-handling) (low, CVSS 3.3, published 14 Sep 2026) - [CVE-2026-90794: GPAC MP4Box use-after-free in gf_sg_script_load](https://junglewise.ai/threats/cve-2026-90794-gpac-mp4box-use-after-free-in-gf-sg-script-load) (medium, CVSS 6.3, published 14 Sep 2026) - [CVE-2026-90793: GPAC MP4Box heap use-after-free in gf_node_get_name](https://junglewise.ai/threats/cve-2026-90793-gpac-mp4box-heap-use-after-free-in-gf-node-get-name) (medium, CVSS 5.4, published 14 Sep 2026) - [CVE-2026-90792: GPAC MP4Box null pointer dereference in gf_node_list_get_child](https://junglewise.ai/threats/cve-2026-90792-gpac-mp4box-null-pointer-dereference-in-gf-node-list-get-child) (medium, CVSS 4.3, published 14 Sep 2026) - [CVE-2026-90791: GPAC MP4Box use-after-free in gf_node_unregister](https://junglewise.ai/threats/cve-2026-90791-gpac-mp4box-use-after-free-in-gf-node-unregister) (medium, CVSS 6.3, published 14 Sep 2026) ## Most severe Gpac vulnerabilities - [CVE-2026-71614: GPAC integer underflow in dvb_mpe.c](https://junglewise.ai/threats/cve-2026-71614-gpac-integer-underflow-in-dvb-mpe-c) (high, CVSS 8.4, published 9 Sep 2026) - [CVE-2026-71612: GPAC buffer overflow in nhntdmx_process via long file path](https://junglewise.ai/threats/cve-2026-71612-gpac-buffer-overflow-in-nhntdmx-process-via-long-file-path) (high, CVSS 8.4, published 9 Sep 2026) - [CVE-2026-71613: GPAC buffer overflow in j2kdec_process JP2 decoder](https://junglewise.ai/threats/cve-2026-71613-gpac-buffer-overflow-in-j2kdec-process-jp2-decoder) (high, CVSS 7.8, published 9 Sep 2026) - [CVE-2026-52489: GPAC buffer overflow in SVG name handling](https://junglewise.ai/threats/cve-2026-52489-gpac-buffer-overflow-in-svg-name-handling) (high, CVSS 7.8, published 25 Aug 2026) - [CVE-2026-92399: GPAC heap-based buffer overflow in WebSocket handler](https://junglewise.ai/threats/cve-2026-92399-gpac-heap-based-buffer-overflow-in-websocket-handler) (high, CVSS 7.3, published 16 Sep 2026) - [CVE-2026-93331: GPAC out-of-bounds read in RTP depacketizer](https://junglewise.ai/threats/cve-2026-93331-gpac-out-of-bounds-read-in-rtp-depacketizer) (high, CVSS 7.3, published 18 Sep 2026) - [CVE-2026-79522: GPAC out-of-bounds read in downloader HTTP client](https://junglewise.ai/threats/cve-2026-79522-gpac-out-of-bounds-read-in-downloader-http-client) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-79514: GPAC out-of-bounds read in downloader via chunked HTTP response](https://junglewise.ai/threats/cve-2026-79514-gpac-out-of-bounds-read-in-downloader-via-chunked-http-response) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-79513: GPAC divide-by-zero in dash_client timeline parsing](https://junglewise.ai/threats/cve-2026-79513-gpac-divide-by-zero-in-dash-client-timeline-parsing) (medium, CVSS 6.5, published 9 Sep 2026) - [CVE-2026-91089: GPAC use after free in gf_node_get_name_and_id](https://junglewise.ai/threats/cve-2026-91089-gpac-use-after-free-in-gf-node-get-name-and-id) (medium, CVSS 6.3, published 15 Sep 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, down 75% on the four before (28). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 11 | 0 | 0 | | 14 Sep 2026 | 26 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 1 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Gpac technologies - [GPAC](https://junglewise.ai/threats/technologies/gpac): 52 vulnerabilities - [Gpac MP4Box](https://junglewise.ai/threats/technologies/mp4box): 32 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Gpac vulnerabilities", https://junglewise.ai/threats/vendors/gpac, 13 November 2026.