SecAlerts
G

GPAC

Security Risk Profile

32
/100
low

Security Risk Score

Comprehensive risk assessment based on 534 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from March 7, 2018 to present

534
Total CVEs
166
Critical+High
1
Exploited
44
Unpatched

Threat Assessment

Avg CVSS
6.1
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
44
Critical/High
Risk Level
32/100
low
⚠️ 1 Active Exploits📈 32 in Last 30 Days

Severity Distribution

Critical
13
High
153
Medium
273
Low
43

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
56

Age Distribution

Common Weaknesses (CWE)

1
Buffer Overflow
159
2
Null Pointer Dereference
121
3
Use After Free
50
4
Integer Overflow
38
5
Double Free
10

Most Affected Products

1. Gpac GPAC480
2. debian/gpac146
3. Gpac MP4Box128
4. ubuntu/gpac78
5. Debian Debian Linux64

Recent Vulnerabilities

See more →
CVE-2026-124031
CVSS 6.8medium

GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4

Nov 6, 2026🔧 No Patch
CVE-2026-124030
CVSS 6.8medium

GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace

Nov 6, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/409
unknown

CVE-2025-60475: GPAC/MP4Box: Global Buffer Overflow ad in gf_ac4_parser_bs on crafted AC-4 stam

Oct 27, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/395
unknown

CVE-2025-60467: GPAC/MP4Box: Use-After-Fe in gf_filter_pid_inst_swap_delete_task on crafted MPEG-2 TS file

Oct 26, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/378
unknown

CVE-2025-60477: GPAC/MP4Box: NULL Pointer Defence in gf_filter_pid_solve_file_template_ex on crafted MP4 with special metadata

Oct 25, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/377
unknown

CVE-2025-60493: GPAC/MP4Box: NULL Pointer Defence in check_media_profile via Crafted MP4 Input

Oct 24, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/354
unknown

CVE-2025-60494: invalid memory ad in GPAC/MP4Box gf_props_equal_internal via crafted MP4 input

Oct 23, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/355
unknown

CVE-2025-60497: NULL pointer defence in GPAC/MP4Box GetESD via crafted MP4 input

Oct 23, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/352
unknown

CVE-2025-60491: heap use-after-fe in GPAC/MP4Box dasher_flush_segment via crafted MPEG-2 TS input

Oct 23, 2026🔧 No Patch
https://seclists.org/oss-sec/2026/q4/350
unknown

CVE-2025-60489: NULL pointer defence in GPAC/MP4Box dasher_insert_timeline_entry via crafted MP4 input

Oct 23, 2026🔧 No Patch

Monitor GPAC in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.