CVE-2022-29537: Gpac

Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days.

gp_rtp_builder_do_hevc in ietf/rtp_pck_mpeg4.c in GPAC 2.0.0 has a heap-based buffer over-read, as demonstrated by MP4Box.

Affected products

• Gpac Gpac: version 2.0.0 only

Published 2022-04-20. Last modified 2026-06-17.