Threats affecting pkg:github/zakkanijia/GPAC

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

CVE-2025-60495 is a medium severity vulnerability in the GPAC Project's MP4Box tool before version 26.02.0. It involves a segmentation violation in the gf_media_get_color_info function, which can be triggered by processing a crafted data file. This leads to a denial of service (DoS) condition. There is no confirmed patch or official remediation available at this time. No known exploits are reported in the wild.

CVE-2025-60486 is a medium severity vulnerability in the GPAC Project's MP4Box tool before version 26.02.0. It involves a heap use-after-free flaw in the dasher_process function within the /filters/dasher.c source file. An attacker can trigger a Denial of Service (DoS) by supplying a specially crafted MPEG-2 file. There is no confirmed patch or official remediation available as of the published date. The vulnerability requires local access with low attack complexity and no privileges but user interaction is needed. No known exploits have been reported in the wild.

CVE-2025-60485 is a vulnerability in the GPAC Project's MP4Box software before version 26.02.0. It involves a segmentation violation in the gf_isom_apple_set_tag_ex function, which can be triggered by processing a specially crafted MP4 file. This vulnerability allows an attacker to cause a denial of service (DoS) by crashing the application. The vulnerability has a medium severity with a CVSS score of 5.5. There is no information about an available patch or official remediation at this time.

CVE-2025-60483 is a medium severity vulnerability in the GPAC Project/MP4Box software before version 26.02.0. It involves a NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function within the av_parsers.c source file. An attacker can trigger a denial of service (DoS) by supplying a specially crafted AC4 media file. There is no confirmed patch or official remediation available as of the published date. The vulnerability requires local access (AV:L) and user interaction (UI:R) to exploit, and it does not impact confidentiality or integrity, only availability. No known exploits are reported in the wild, and no vendor advisory or patch information is currently available.

CVE-2025-60481 is a medium severity vulnerability in the GPAC Project/MP4Box software prior to version 26.02.0. It involves a NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 function within the /odf/descriptors.c file. An attacker can trigger a denial of service (DoS) by supplying a specially crafted AC4 file. There is no confirmed patch or official remediation available at this time.

CVE-2025-55664 is a heap buffer overflow vulnerability in the m2tsdmx_send_packet function of GPAC MP4Box version 2.4. This flaw allows an attacker to cause a denial of service (DoS) by supplying a specially crafted MP4 file. The vulnerability does not impact confidentiality or integrity but can disrupt availability by crashing the application. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.

A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isom_intern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.

CVE-2026-8124 is a medium severity vulnerability in GPAC version 26.02.0 affecting the sidx_box_read function in src/isomedia/box_code_base.c. The issue involves improper allocation of resources triggered by local manipulation. Exploitation requires local access and no user interaction. A patch has been identified but no official remediation level or vendor advisory is provided. The vulnerability has been publicly disclosed but no known exploits are reported in the wild.

A security vulnerability has been detected in GPAC 26.03-DEV. Affected by this vulnerability is the function svgin_process of the file src/filters/load_svg.c of the component SVG Parser. The manipulation leads to out-of-bounds write. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. The identifier of the patch is 7618d7206cdeb3c28961dc97ab0ecabaff0c8af2. It is suggested to install a patch to address this issue.

A weakness has been identified in GPAC 26.03-DEV. Affected is the function txtin_process_texml of the file src/filters/load_text.c of the component TeXML File Parser. Executing a manipulation can lead to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. This patch is called d29f6f1ada5cc284cdfa783b6f532c7d8bd049a5. Applying a patch is advised to resolve this issue.

A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0e4fe71772. It is best practice to apply a patch to resolve this issue.

A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: f96bd57c3ccdcde4335a0be28cd3e8fe296993de. Applying a patch is the recommended action to fix this issue.

A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as d45c264c20addf0c1cc05124ede33f8ffa800e68. It is advisable to implement a patch to correct this issue.

A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix this issue, it is recommended to deploy a patch.

A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.

A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file.