Where
AND
-Infinity
0
Severity
7.5
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmxnhml.c:1004 in the nhmldmxsendsample() function szXmlTo parameter which leads to a denial of service vulnerability.

First published (updated )
Severity
7.5
Buffer Overflow
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

There is a stack buffer overflow in MP4Box v1.0.1 at src/filters/dmxnhml.c:1008 in the nhmldmxsendsample() function szXmlFrom parameter which leads to a denial of service vulnerability.

First published (updated )
Severity
7.8
Double Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gftextgetutf8line function in loadtext.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.

1 / 2
First published (updated )
Severity
5.5
Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

There is a integer overflow in mediatools/avparsers.c in the gfavcreadppsbsinternal in GPAC 1.0.1. ppsid may be a negative number, so it will not return. However, avc->pps only has 255 unit, so there is an overflow, which results a crash.

1 / 2
First published (updated )
Severity
5.5
Integer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

There is a integer overflow in mediatools/avparsers.c in the hevcparseslicesegment function in GPAC 1.0.1 which results in a crash.

1 / 2
First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the MediaIsSelfContained function, which could cause a Denial of Service. .

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1via ShiftMetaOffset.isra, which causes a Denial of Service (context-dependent).

First published (updated )
Severity
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

GPAC 1.0.1 is affected by: Abort failed. The impact is: cause a denial of service (context-dependent).

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Derefernce Vulnerbility exists GPAC 1.0.1 the gfisomboxsize function, which could cause a Denial of Service (context-dependent).

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gfhinterfinalize function.

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gffileiocheck function, which could cause a Denial of Service.

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the shiftchunkoffsets.part function, which causes a Denial of Service (context-dependent).

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlinkchunk.isra, which causes a Denial of Service (context-dependent).

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the finplaceshiftmoovmetaoffsets function, which causes a Denial of Servie (context-dependent).

First published (updated )
Severity
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Segmentation Fault Vulnerability exists in GPAC 1.0.1 via the co64boxnew function, which causes a Denial of Service.

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the fseeko function, which causes a Denial of Service.

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Pointer Dereference Vulnerability exits in GPAC 1.0.1 in the gflistcount function, which causes a Denial of Service.

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 in MP4Box via strlenavx2, which causes a Denial of Service.

First published (updated )
Severity
5.5
Use After Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

The gfdumpsetup function in GPAC 1.0.1 allows malicoius users to cause a denial of service (Invalid memory address dereference) via a crafted file in the MP4Box command.

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

The gfisomhintrtpread function in GPAC 1.0.1 allows attackers to cause a denial of service (Invalid memory address dereference) via a crafted file in the MP4Box command.

First published (updated )
Severity
5.5
Double Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Double Free vulnerability exists in filedump.c in GPAC 1.0.1, which could cause a Denail of Service via a crafted file in the MP4Box command.

First published (updated )
Severity
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A vulnerability exists in GPAC 1.0.1 due to an omission of security-relevant Information, which could cause a Denial of Service. The program terminates with signal SIGKILL.

First published (updated )
Severity
7.8
Buffer Overflow
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is heap-based buffer overflow in the function gprtpbuilderdoavc() in ietf/rtppckmpeg4.c.

First published (updated )
Severity
7.8
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function gfhintertrackfinalize() in mediatools/isomhinter.c.

First published (updated )
Severity
7.8
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is an invalid pointer dereference in the function SetupWriters() in isomedia/isomstore.c.

First published (updated )
Severity
7.8
Use After Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in GPAC version 0.8.0 and 1.0.1. There is a use-after-free in the function gfisomboxdel() in isomedia/boxfuncs.c.

First published (updated )
Severity
5.5
Double Free
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

The binary MP4Box in Gpac 1.0.1 has a double-free vulnerability in the gflistdel function in list.c, which allows attackers to cause a denial of service.

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A null pointer deference vulnerability exists in gpac through 1.0.1 via the naludmxparsenalavc function in reframenalu, which allows a denail of service.

First published (updated )
Severity
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Segmentation fault caused by a floating point exception exists in Gpac through 1.0.1 using mp4box via the naludmxenqueueordispatch function in reframenalu.c, which causes a denial of service.

First published (updated )
Severity
5.5
Null Pointer Dereference
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A Segmentation fault caused by a null pointer dereference vulnerability exists in Gpac through 1.0.1 via the gfavcparsenalu function in avparsers.c when using mp4box, which causes a denial of service.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203