Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

GPAC bug bounty programs

gpac.io Updated

GPAC runs one public program: a Sorona bug bounty paying up to $1,500.

Top reward
$1,500
Sorona
Programs
1
1 pays cash
Targets in scope
12
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program GPAC runs.

  • GPAC

    Sorona · Bug bounty

    Open

    Top reward

    $1,500
    Critical
    –
    High
    –
    Medium
    –
    Low
    $100
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

12 targets. 5 excluded.

  • https://gpac.io

    Web

  • Codec bitstream parsing where GPAC does it itself: AVC, HEVC, AV1 and VVC parameter sets and their inspection paths

    Products and areas

  • Demuxers for the other containers GPAC reads, covering MPEG-2 TS, AVI, Matroska and the raw elementary stream readers

    Products and areas

  • Encryption and DRM handling: CENC, key management and the encrypted-media paths

    Products and areas

  • MP4Box itself, every option it accepts and every file it will open on the strength of one

    Products and areas

  • Network-facing code: the DASH and HLS clients, HTTP handling and the RTP and RTSP stack

    Products and areas

  • Subtitle and caption handling, including the VobSub index reader and the timed-text formats

    Products and areas

  • The DASH, HLS and CMAF segmenters, plus the manifest parsers on the client side: MPD, m3u8 and Smooth Streaming index parsing

    Products and areas

  • The filter session and the whole filter graph, including how filters are linked and how buffers move between them

    Products and areas

  • The ISOBMFF and MP4 layer in libgpac: box parsing, sample tables, fragmented MP4 and the movie fragment index

    Products and areas

  • The player and the bindings, covering the gpac player, the Node and Python interfaces and anything that drives libgpac programmatically

    Products and areas

  • The policy takes vulnerability reports through the public issue tracker by default and through [email protected] where openness is inappropriate. It names no component boundary, so the whole toolkit is in

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 5

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • Bugs in third-party libraries GPAC links against rather than in GPAC's own code

  • Distribution packaging rather than upstream code

  • Format-support gaps and files GPAC simply refuses to open

  • Isolated overflows produced by a fuzzer that do not lead to a crash, ruled out by name in the policy

  • Requests for a project-assigned CVE, since GPAC states it does not assign them

Recent changes

Reward and scope changes across every GPAC program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in GPAC products, from the NVD.

Search NVD
  • CVE-2026-79522 Medium

    An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

  • CVE-2026-79513 Medium

    A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

  • CVE-2026-79514 Medium

    An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

  • CVE-2025-60464 High

    A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.

  • CVE-2025-60465 Medium

    A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

  • CVE-2025-60466 Medium

    A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

  • CVE-2025-60473 Medium

    A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

  • CVE-2025-60467 High

    A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

About this page

This page gathers every public program listed under gpac.io: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.