How many CVEs does GPAC have?

GPAC has 473 published CVE records since 2018, including 119 in the last two years.

How many GPAC CVEs are in CISA KEV?

None of GPAC's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which GPAC products have the most CVEs?

The GPAC products with the most published CVEs are gpac, gpac/gpac, MP4Box, GPAC 2.2, GPAC 2.3.

What are the most common weakness types in GPAC CVEs?

GPAC's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-787 (Out-of-bounds Write), CWE-416 (Use After Free), CWE-125 (Out-of-bounds Read).

Are there public exploits for GPAC vulnerabilities?

Yes — 452 of GPAC's CVEs have a known public exploit.

How many critical GPAC vulnerabilities are there?

GPAC has 13 critical and 154 high-severity CVEs.

What is the average severity of GPAC CVEs?

The average CVSS base score across GPAC's scored CVEs is 6.3.

RadicalNotion.AI

Log in Create an account

473 CVEs

GPAC Vulnerabilities

Name: GPAC vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for GPAC.

473

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

452

Public exploits

PoC or exploit code

6.3

Avg CVSS

2018–2026

Overview

GPAC has 473 published CVE records since 2018, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 452 have a known public exploit. The average CVSS base score across scored CVEs is 6.3.

Security scorecard

A quick read on GPAC's vulnerability posture, as a share of its 473 published CVEs.

Average CVSS: 6.3
Critical / high: 35%
Actively exploited (KEV): 0%
Public exploit available: 96%
Patch available: 82%

Severity and exploitation

How the CVSS severity of GPAC's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical13

High154

Medium298

Low6

2 additional CVEs have no CVSS severity score.

In CISA’s Known Exploited Vulnerabilities catalog

0

None of GPAC's CVEs are currently listed in CISA's KEV catalog.

Public exploits

452

452 of GPAC's CVEs have a known public exploit available.

Most affected products

The GPAC products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in GPAC CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish GPAC CVE records.

Disclosure activity by year

How many GPAC CVEs were published each year.

2019

26

2020

9

2021

116

2022

98

2023

84

2024

17

2025

6

2026

113

Latest GPAC CVEs

The most recently disclosed vulnerabilities affecting GPAC.

Vulnerability vulnerability · 2026-10-16
Unscored
2026-10-16
Vulnerability vulnerability · 2026-10-16
Unscored
2026-10-16
GPAC AIT Parser ait.c gf_m2ts_decode_ait out-of-bounds write
CWE-787
Medium · CVSS 5.3
EPSS 0.3%2026-10-13
GPAC MP4Box filter_queue.c gf_fq_pop use after free
CWE-416
Medium · CVSS 5.3
EPSS 0.3%2026-10-11
GPAC MP4Box os_thread.c gf_mx_v use after free
CWE-416
Medium · CVSS 5.3
EPSS 0.2%2026-10-11
GPAC DASH Client dash_client.c gf_dash_resolve_url buffer overflow
CWE-120
Medium · CVSS 5.3
EPSS 0.5%2026-09-30
GPAC RTP Depacketizer rtp_depacketizer.c gf_rtp_parse_ttxt out-of-bounds
CWE-125
Medium · CVSS 6.9
EPSS 0.5%2026-09-18
GPAC downloader.c wait_for_header_and_parse out-of-bounds
CWE-125
Medium · CVSS 4.8
EPSS 0.2%2026-09-16
GPAC Proto Link mpeg4_inline.c gf_inline_get_proto_lib use after free
CWE-416
Medium · CVSS 4.8
EPSS 0.2%2026-09-16
GPAC BIFS commands.c gf_sg_command_del use after free
CWE-416
Medium · CVSS 4.8
EPSS 0.2%2026-09-16
GPAC MP4Box base_scenegraph.c gf_node_deactivate_ex use after free
CWE-416
Medium · CVSS 4.8
EPSS 0.2%2026-09-16
GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow
CWE-122
Medium · CVSS 6.9
EPSS 0.7%2026-09-16

Get an alert for each new GPAC CVE, with AI-written analysis and remediation steps.

Monitor GPAC CVEs

Other vendors

CVE counts for other vendors.

fabian484 CVEs Atlassian481 CVEs Citrix477 CVEs mediawiki476 CVEs Wikimedia Foundation474 CVEs HackerOne470 CVEs Palo Alto Networks457 CVEs Magento455 CVEs

Browse all vendors

Frequently asked questions

Common questions about GPAC vulnerabilities.

How many CVEs does GPAC have?: GPAC has 473 published CVE records since 2018, including 119 in the last two years.
How many GPAC CVEs are in CISA KEV?: None of GPAC's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which GPAC products have the most CVEs?: The GPAC products with the most published CVEs are gpac, gpac/gpac, MP4Box, GPAC 2.2, GPAC 2.3.
What are the most common weakness types in GPAC CVEs?: GPAC's CVEs most often map to these CWE weakness types: CWE-476 (NULL Pointer Dereference), CWE-787 (Out-of-bounds Write), CWE-416 (Use After Free), CWE-125 (Out-of-bounds Read).
Are there public exploits for GPAC vulnerabilities?: Yes — 452 of GPAC's CVEs have a known public exploit.
How many critical GPAC vulnerabilities are there?: GPAC has 13 critical and 154 high-severity CVEs.
What is the average severity of GPAC CVEs?: The average CVSS base score across GPAC's scored CVEs is 6.3.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track GPAC vulnerabilities

Get an alert for each new GPAC CVE, with AI-written analysis and remediation steps.

Create an account See pricing