- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 425
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Public disclosure allowed
- You may publish your report.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 5 excluded.
Web 1
- https://gpac.io
Products and areas 11
- Codec bitstream parsing where GPAC does it itself: AVC, HEVC, AV1 and VVC parameter sets and their inspection paths
- Demuxers for the other containers GPAC reads, covering MPEG-2 TS, AVI, Matroska and the raw elementary stream readers
- Encryption and DRM handling: CENC, key management and the encrypted-media paths
- MP4Box itself, every option it accepts and every file it will open on the strength of one
- Network-facing code: the DASH and HLS clients, HTTP handling and the RTP and RTSP stack
- Subtitle and caption handling, including the VobSub index reader and the timed-text formats
- The DASH, HLS and CMAF segmenters, plus the manifest parsers on the client side: MPD, m3u8 and Smooth Streaming index parsing
- The filter session and the whole filter graph, including how filters are linked and how buffers move between them
- The ISOBMFF and MP4 layer in libgpac: box parsing, sample tables, fragmented MP4 and the movie fragment index
- The player and the bindings, covering the gpac player, the Node and Python interfaces and anything that drives libgpac programmatically
- The policy takes vulnerability reports through the public issue tracker by default and through [email protected] where openness is inappropriate. It names no component boundary, so the whole toolkit is in
Out of scope (5)
- Bugs in third-party libraries GPAC links against rather than in GPAC's own code
- Distribution packaging rather than upstream code
- Format-support gaps and files GPAC simply refuses to open
- Isolated overflows produced by a fuzzer that do not lead to a crash, ruled out by name in the policy
- Requests for a project-assigned CVE, since GPAC states it does not assign them
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Use the private address when the finding is exploitable rather than a crash
-
Attach the input file and the exact MP4Box or gpac command line.
-
GPAC does not assign CVEs. If you want an identifier you request it from MITRE yourself
-
The project does not use GitHub Security Advisories, so expect the fix in a commit and a release rather than in a published advisory
Not accepted
-
Isolated overflows produced by a fuzzer that do not lead to a crash
-
Bugs in third-party libraries GPAC links against rather than in GPAC's own code
-
Requests for a project-assigned CVE
-
Format-support gaps and files GPAC simply refuses to open
-
Distribution packaging rather than upstream code
-
isolated overflows generated by fuzzers that do not lead to a crash
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-79522 | An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640. | Medium 6.5 | 9 Sep 2026 |
| CVE-2026-79513 | A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640. | Medium 6.5 | 9 Sep 2026 |
| CVE-2026-79514 | An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640. | Medium 6.5 | 9 Sep 2026 |
| CVE-2025-60464 | A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file. | High 7.8 | 25 Jun 2026 |
| CVE-2025-60465 | A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file. | Medium 6.1 | 25 Jun 2026 |
| CVE-2025-60466 | A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file. | Medium 5.0 | 25 Jun 2026 |
| CVE-2025-60473 | A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file. | Medium 5.5 | 25 Jun 2026 |
| CVE-2025-60467 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file. | High 7.5 | 24 Jun 2026 |
| CVE-2025-60474 | A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input. | High 7.5 | 24 Jun 2026 |
| CVE-2025-60468 | GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filter_core/filter_pid.c (L:574-580): function gf_filter_pid_inst_swap_delete_task() improperly accesses freed objects during PID instance swap/delete cleanup, leading to heap use-after-free. The attack vector | Medium 5.5 | 24 Jun 2026 |
| CVE-2025-60471 | A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file. | Medium 5.5 | 24 Jun 2026 |
| CVE-2025-55639 | GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. | Medium 6.5 | 23 Jun 2026 |
| CVE-2025-55648 | A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55649 | A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55650 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55652 | A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55660 | A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55661 | A heap buffer overflow in the Opus audio stream parser component of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55663 | A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55645 | A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55647 | An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55641 | A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55642 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c). | Medium 6.5 | 15 Jun 2026 |
| CVE-2025-55643 | A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55644 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 15 Jun 2026 |
| CVE-2025-55658 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c). bThis vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. | Medium 6.5 | 9 Jun 2026 |
| CVE-2025-55659 | A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 6.5 | 9 Jun 2026 |
| CVE-2025-52292 | A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | High 7.5 | 9 Jun 2026 |
| CVE-2025-52293 | A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying crafted HEVC SPS data. | High 7.5 | 9 Jun 2026 |
| CVE-2025-55651 | A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | Medium 5.5 | 9 Jun 2026 |
| CVE-2025-55657 | A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | High 7.5 | 9 Jun 2026 |
| CVE-2026-9572 | A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854e | Low 1.9 | 26 May 2026 |
| CVE-2026-8124 | A security vulnerability has been detected in GPAC up to 26.02.0. This affects the function sidx_box_read of the file src/isomedia/box_code_base.c. The manipulation leads to allocation of resources. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is 442e2299530138d8f874fd885c565ba98a6318ba. It is suggested to install a pa | Low 1.9 | 8 May 2026 |
| CVE-2026-39103 | Buffer Overflow vulnerability in GPAC before commit v391dc7f4d234988ea0bc3cc294eb725eddf8f702 allows an attacker to cause a denial of service via the src/scenegraph/svg_attributes.c, svg_parse_strings(), gf_svg_parse_attribute() | Medium 5.5 | 5 May 2026 |
| CVE-2026-33144 | GPAC is an open-source multimedia framework. Prior to commit 86b0e36, a heap-based buffer overflow (write) vulnerability was discovered in GPAC MP4Box. The vulnerability exists in the gf_xml_parse_bit_sequence_bs function in utils/xml_bin_custom.c when processing a crafted NHML file containing malicious <BS> (BitSequence) elements. An attacker can exploit this by providing a specially crafted NHML | Medium 5.8 | 20 Mar 2026 |
| CVE-2026-27821 | GPAC is an open-source multimedia framework. In versions up to and including 26.02.0, a stack buffer overflow occurs during NHML file parsing in `src/filters/dmx_nhml.c`. The value of the xmlHeaderEnd XML attribute is copied from att->value into szXmlHeaderEnd[1000] using strcpy() without any length validation. If the input exceeds 1000 bytes, it overwrites beyond the stack buffer boundary. Commit | High 7.7 | 26 Feb 2026 |
| CVE-2026-1416 | A security flaw has been discovered in GPAC up to 2.4.0. Affected by this vulnerability is the function DumpMovieInfo of the file applications/mp4box/filedump.c. The manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is identified as d45c264c20addf0c1cc05124ede33f8f | Low 1.9 | 26 Jan 2026 |
| CVE-2026-1417 | A weakness has been identified in GPAC up to 2.4.0. Affected by this issue is the function dump_isom_rtp of the file applications/mp4box/filedump.c. This manipulation causes null pointer dereference. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. Patch name: f96bd57c3ccdcde4335a0be28cd3e8fe296993de. Applying a patch is the | Low 1.9 | 26 Jan 2026 |
| CVE-2026-1418 | A security vulnerability has been detected in GPAC up to 2.4.0. This affects the function gf_text_import_srt_bifs of the file src/scene_manager/text_to_bifs.c of the component SRT Subtitle Import. Such manipulation leads to out-of-bounds write. The attack needs to be performed locally. The exploit has been disclosed publicly and may be used. The name of the patch is 10c73b82cf0e367383d091db38566a0 | Low 1.9 | 26 Jan 2026 |
| CVE-2026-1415 | A vulnerability was identified in GPAC up to 2.4.0. Affected is the function gf_media_export_webvtt_metadata of the file src/media_tools/media_export.c. The manipulation of the argument Name leads to null pointer dereference. The attack must be carried out locally. The exploit is publicly available and might be used. The identifier of the patch is af951b892dfbaaa38336ba2eba6d6a42c25810fd. To fix t | Low 1.9 | 26 Jan 2026 |
| CVE-2025-70302 | A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | Medium 5.5 | 15 Jan 2026 |
| CVE-2025-70303 | A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. | Medium 5.5 | 15 Jan 2026 |
| CVE-2025-70299 | A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted AVI file. | Medium 6.5 | 15 Jan 2026 |
| CVE-2025-70307 | A stack overflow in the dump_ttxt_sample function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet. | High 7.5 | 15 Jan 2026 |
| CVE-2025-70308 | An out-of-bounds read in the GSF demuxer filter component of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .gsf file. | High 7.5 | 15 Jan 2026 |
| CVE-2025-70309 | A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted WAV file. | Medium 5.5 | 15 Jan 2026 |
| CVE-2025-70310 | A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .ogg file. | Medium 5.5 | 15 Jan 2026 |
| CVE-2025-70298 | GPAC v2.4.0 was discovered to contain an out-of-bounds read in the oggdmx_parse_tags function. | High 8.2 | 15 Jan 2026 |
| CVE-2025-70304 | A buffer overflow in the vobsub_get_subpic_duration() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted packet. | High 7.5 | 15 Jan 2026 |
| CVE-2025-70305 | A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted .saf file. | Medium 5.5 | 15 Jan 2026 |
| CVE-2025-7797 | A vulnerability was found in GPAC up to 2.4. It has been rated as problematic. Affected by this issue is the function gf_dash_download_init_segment of the file src/media_tools/dash_client.c. The manipulation of the argument base_init_url leads to null pointer dereference. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 1 | Medium 5.5 | 18 Jul 2025 |
| CVE-2025-25723 | Buffer Overflow vulnerability in GPAC version 2.5 allows a local attacker to execute arbitrary code. | High 8.4 | 28 Feb 2025 |
| CVE-2024-57184 | An issue was discovered in GPAC v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_process_pmt in media_tools/mpegts.c:2163 that can cause a denial of service (DOS) via a crafted MP4 file. | Medium 5.5 | 24 Jan 2025 |
| CVE-2024-50664 | gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box. | High 7.8 | 23 Jan 2025 |
| CVE-2024-50665 | gpac 2.4 contains a SEGV at src/isomedia/drm_sample.c:1562:96 in isom_cenc_get_sai_by_saiz_saio in MP4Box. | Medium 5.5 | 23 Jan 2025 |
| CVE-2023-4679 | A use after free vulnerability exists in GPAC version 2.3-DEV-revrelease, specifically in the gf_filterpacket_del function in filter_core/filter.c at line 38. This vulnerability can lead to a double-free condition, which may cause the application to crash. | Medium 5.5 | 15 Nov 2024 |
| CVE-2024-6064 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been declared as problematic. This vulnerability affects the function xmt_node_end of the file src/scene_manager/loader_xmt.c of the component MP4Box. The manipulation leads to use after free. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patc | Medium 4.8 | 17 Jun 2024 |
| CVE-2024-6063 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b0228 | Medium 4.8 | 17 Jun 2024 |
| CVE-2024-6061 | A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifi | Medium 4.8 | 17 Jun 2024 |
| CVE-2024-6062 | A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identifie | Medium 4.8 | 17 Jun 2024 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 68 Last 12 months 425 Lifetime Memory safety 50 % Parsing/validation 25 % Denial of service 20 % Info disclosure 5 % Latest advisories Loading the feed Overview GPAC is the MP4Box toolkit and the packager that turns mezzanine files into DASH and HLS output. It sits inside broadcast and streaming infrastructure, and inside a good deal of tooling that ingests video nobody vetted first. It also carries the heaviest bug yield in this whole category: 68 CVEs in the last twelve months, most of them memory corruption reached by handing MP4Box a malformed container. CVE-2026-15185 in the VobSub index reader is a representative entry. The project offers no reward and does not assign CVEs itself, pointing reporters at MITRE instead. sorona.xyz pays you directly on qualified, reproduced findings. In scope The policy takes vulnerability reports through the public issue tracker by default and through [email protected] where openness is inappropriate. It names no component boundary, so the whole toolkit is in The ISOBMFF and MP4 layer in libgpac: box parsing, sample tables, fragmented MP4 and the movie fragment index MP4Box itself, every option it accepts and every file it will open on the strength of one The filter session and the whole filter graph, including how filters are linked and how buffers move between them The DASH, HLS and CMAF segmenters, plus the manifest parsers on the client side: MPD, m3u8 and Smooth Streaming index parsing Demuxers for the other containers GPAC reads, covering MPEG-2 TS, AVI, Matroska and the raw elementary stream readers Subtitle and caption handling, including the VobSub index reader and the timed-text formats Codec bitstream parsing where GPAC does it itself: AVC, HEVC, AV1 and VVC parameter sets and their inspection paths Network-facing code: the DASH and HLS clients, HTTP handling and the RTP and RTSP stack Encryption and DRM handling: CENC, key management and the encrypted-media paths The player and the bindings, covering the gpac player, the Node and Python interfaces and anything that drives libgpac programmatically Out of scope Isolated overflows produced by a fuzzer that do not lead to a crash, ruled out by name in the policy Bugs in third-party libraries GPAC links against rather than in GPAC's own code Requests for a project-assigned CVE, since GPAC states it does not assign them Format-support gaps and files GPAC simply refuses to open Distribution packaging rather than upstream code Most-valued findings Memory corruption in the ISOBMFF box layer reached from an ordinary MP4 handed to MP4Box. This is the densest part of a 425-CVE record and it fires wherever a pipeline accepts an upload Anything reaching a write primitive rather than a read. With this much fuzz-shaped volume, a demonstrated write is what separates a report from the noise Manifest parsing on the client side, the CVE-2026-50810 shape, where a NULL dereference in Smooth Streaming index parsing comes off a remote manifest rather than a local file The subtitle and index readers, where CVE-2026-15185 landed in the VobSub path. These parsers get a fraction of the attention the container code gets Bugs reachable through a plain MP4Box command line rather than through an exotic harness, since the policy explicitly discards fuzzer artefacts that never reach a crash Defects in the encryption and key-handling paths, where the failure is confidentiality rather than a crash Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Read the channel carefully before filing. The policy sends vulnerabilities to the public GitHub issue tracker by default, and reserves [email protected] for cases where public disclosure seems unreasonable or confidential information has to be shared Use the private address when the finding is exploitable rather than a crash, since the default channel puts the detail in the open immediately Fuzzer noise is excluded by name: isolated overflows generated by fuzzers that do not lead to a crash will not be treated as vulnerabilities Attach the input file and the exact MP4Box or gpac command line. The bug yield here is high enough that a report without a minimal repro competes with a lot of other reports GPAC does not assign CVEs. If you want an identifier you request it from MITRE yourself The project does not use GitHub Security Advisories, so expect the fix in a commit and a release rather than in a published advisory There is no reward. The SECURITY.md mentions none Disclosure Unusually open. The default path is a public issue, so disclosure often begins at the moment of reporting, and fixes land as ordinary commits rather than as advisories. Where you use [email protected] instead, coordinate the timing with the maintainers directly, since the policy sets no embargo period and the project publishes no advisory stream to embargo against. Identifiers come from MITRE on your own initiative. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability