Threats affecting pkg:github/GPAC

97 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.5	EPSS 0.5%	CVE-2025-70307GPAC · Stack-based Buffer Overflow High7.5EPSS 0.5%2026-01-15CVE Database V5CVE-2025-70307 A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet. EPSS 0.5%Vulnerability CWE-121	CVE Database V5	2026-01-15
Medium	5.5	EPSS 0.2%	CVE-2025-70305GPAC · Stack-based Buffer Overflow Medium5.5EPSS 0.2%2026-01-15CVE Database V5CVE-2025-70305 A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file. EPSS 0.2%Vulnerability CWE-121	CVE Database V5	2026-01-15
High	8.2	EPSS 0.4%	CVE-2025-70298GPAC · Out-of-bounds Read High8.2EPSS 0.4%2026-01-15CVE Database V5CVE-2025-70298 GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function. EPSS 0.4%Vulnerability CWE-125	CVE Database V5	2026-01-15
Medium	5.5	EPSS 0.2%	CVE-2025-70310GPAC · Heap-based Buffer Overflow Medium5.5EPSS 0.2%2026-01-15CVE Database V5CVE-2025-70310 A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .ogg file. EPSS 0.2%Vulnerability CWE-122	CVE Database V5	2026-01-15
High	7.5	EPSS 0.4%	CVE-2025-70308GPAC · Out-of-bounds Read High7.5EPSS 0.4%2026-01-15CVE Database V5CVE-2025-70308 An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file. EPSS 0.4%Vulnerability CWE-125	CVE Database V5	2026-01-15
High	7.5	EPSS 0.4%	CVE-2025-70304GPAC · Stack-based Buffer Overflow High7.5EPSS 0.4%2026-01-15CVE Database V5CVE-2025-70304 A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet. EPSS 0.4%Vulnerability CWE-121	CVE Database V5	2026-01-15
Medium	5.5	EPSS 0.2%	CVE-2025-70309GPAC · Stack-based Buffer Overflow Medium5.5EPSS 0.2%2026-01-15CVE Database V5CVE-2025-70309 A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted WAV file. EPSS 0.2%Vulnerability CWE-121	CVE Database V5	2026-01-15
Medium	6.9	EPSS 1.1%	CVE-2025-7797GPAC · NULL Pointer Dereference Medium6.9EPSS 1.1%2025-07-18CVE Database V5CVE-2025-7797 A vulnerability was found in GPAC up to 2.4. It has been rated as problematic. Affected by this issue is the function gf_dash_download_init_segment of the file src/media_tools/dash_client.c. The manipulation of the argument base_init_url leads to null pointer dereference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 153ea314b6b053db17164f8bc3c7e1e460938eaa. It is recommended to apply a patch to fix this issue. EPSS 1.1%Vulnerability	CVE Database V5	2025-07-18
High	7.5	EPSS 1.3%	CVE-2024-24266gpac · Use After Free High7.5EPSS 1.3%2024-02-05CVE Database V5CVE-2024-24266 gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher_configure_pid function at /src/filters/dasher.c. EPSS 1.3%Vulnerability CWE-416	CVE Database V5	2024-02-05
Medium	4.4	EPSS 0.9%	CVE-2024-0322gpac/gpac · Out-of-bounds Read Medium4.4EPSS 0.9%2024-01-08CVE Database V5CVE-2024-0322 Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3-DEV. EPSS 0.9%Vulnerability CWE-125	CVE Database V5	2024-01-08

Page 6 of 6