Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

For many USA companies it is mandatory now to provide a Software Bill of Materials (SBOM) document along with their software releases. To generate this document the software products must be scanned for third-party open source and other third-party code for any potential licensing and/or security issues. 

Our company using for such scans the 'Code Insight' tool owned by Revenera. The scan of one of our products, which uses the Gpac 2.2.1 package, reported the following vulnerability issues in the 3rd party libraries used by Gpac.

1.	Files: 'Gpac\avcodec-59.dll' and 'Gpac\avformat-59.dll' use the library 'madler-zlib 1.2.11' having the issues  [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) and [SA107600](https://secuniaresearch.flexerasoftware.com/advisories/107600/)

2.	File 'Gpac\libgpac.dll' uses the following libraries:
a.	 'madler-zlib 1.2.3' having the issues [CVE-2016-9843](https://nvd.nist.gov/vuln/detail/CVE-2016-9843), [CVE-2016-9841](https://nvd.nist.gov/vuln/detail/CVE-2016-9841), [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), [CVE-2016-9840](https://nvd.nist.gov/vuln/detail/CVE-2016-9840), [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) and [SA107600](https://secuniaresearch.flexerasoftware.com/advisories/107600/)

b.	'libpng 1.2.33' having the issues [CVE-2010-1205](https://nvd.nist.gov/vuln/detail/CVE-2010-1205), [CVE-2017-12652](https://nvd.nist.gov/vuln/detail/CVE-2017-12652), [CVE-2015-8540](https://nvd.nist.gov/vuln/detail/CVE-2015-8540), [CVE-2011-2690](https://nvd.nist.gov/vuln/detail/CVE-2011-2690), [CVE-2011-2692](https://nvd.nist.gov/vuln/detail/CVE-2011-2692), [CVE-2016-3751](https://nvd.nist.gov/vuln/detail/CVE-2016-3751), [CVE-2016-10087](https://nvd.nist.gov/vuln/detail/CVE-2016-10087), [CVE-2015-8472](https://nvd.nist.gov/vuln/detail/CVE-2015-8472), [CVE-2010-2249](https://nvd.nist.gov/vuln/detail/CVE-2010-2249), [CVE-2011-2501](https://nvd.nist.gov/vuln/detail/CVE-2011-2501), [CVE-2011-2691](https://nvd.nist.gov/vuln/detail/CVE-2011-2691) and [SA83997](https://secuniaresearch.flexerasoftware.com/advisories/83997/)

c.	'libjpeg 6b' having the issue [CVE-2020-14152](https://nvd.nist.gov/vuln/detail/CVE-2020-14152)

So, considering the current security concerns across the world and especially taking into account that numerous USA companies are now obligated to provide SBOM document with each release, the outdated 3rd party libraries listed above should be upgraded to their latest versions to avoid the know vulnerability issues.
Vulnerability issues in 3rd party components used by Gpac
This is a GitHub Issue
repo:gpac
owner:gpac
Title : Vulnerability issues in 3rd party components used by Gpac
Issue date:

--- start body ---
Thanks for reporting your issue. Please make sure these boxes are checked before submitting your issue - thank you!

- [x] I looked for a similar issue and couldn't find any.
- [x] I tried with the latest version of GPAC. Installers available at http://gpac.io/downloads/gpac-nightly-builds/
- [] I give enough information for contributors to reproduce my issue (meaningful title, github labels, platform and compiler, command-line ...). I can share files anonymously with this dropbox: https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95

For many USA companies it is mandatory now to provide a Software Bill of Materials (SBOM) document along with their software releases. To generate this document the software products must be scanned for third-party open source and other third-party code for any potential licensing and/or security issues. 

Our company using for such scans the 'Code Insight' tool owned by Revenera. The scan of one of our products, which uses the Gpac 2.2.1 package, reported the following vulnerability issues in the 3rd party libraries used by Gpac.

1.	Files: 'Gpac\avcodec-59.dll' and 'Gpac\avformat-59.dll' use the library 'madler-zlib 1.2.11' having the issues  [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) and [SA107600](https://secuniaresearch.flexerasoftware.com/advisories/107600/)

2.	File 'Gpac\libgpac.dll' uses the following libraries:
a.	 'madler-zlib 1.2.3' having the issues [CVE-2016-9843](https://nvd.nist.gov/vuln/detail/CVE-2016-9843), [CVE-2016-9841](https://nvd.nist.gov/vuln/detail/CVE-2016-9841), [CVE-2022-37434](https://nvd.nist.gov/vuln/detail/CVE-2022-37434), [CVE-2016-9840](https://nvd.nist.gov/vuln/detail/CVE-2016-9840), [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) and [SA107600](https://secuniaresearch.flexerasoftware.com/advisories/107600/)

b.	'libpng 1.2.33' having the issues [CVE-2010-1205](https://nvd.nist.gov/vuln/detail/CVE-2010-1205), [CVE-2017-12652](https://nvd.nist.gov/vuln/detail/CVE-2017-12652), [CVE-2015-8540](https://nvd.nist.gov/vuln/detail/CVE-2015-8540), [CVE-2011-2690](https://nvd.nist.gov/vuln/detail/CVE-2011-2690), [CVE-2011-2692](https://nvd.nist.gov/vuln/detail/CVE-2011-2692), [CVE-2016-3751](https://nvd.nist.gov/vuln/detail/CVE-2016-3751), [CVE-2016-10087](https://nvd.nist.gov/vuln/detail/CVE-2016-10087), [CVE-2015-8472](https://nvd.nist.gov/vuln/detail/CVE-2015-8472), [CVE-2010-2249](https://nvd.nist.gov/vuln/detail/CVE-2010-2249), [CVE-2011-2501](https://nvd.nist.gov/vuln/detail/CVE-2011-2501), [CVE-2011-2691](https://nvd.nist.gov/vuln/detail/CVE-2011-2691) and [SA83997](https://secuniaresearch.flexerasoftware.com/advisories/83997/)

c.	'libjpeg 6b' having the issue [CVE-2020-14152](https://nvd.nist.gov/vuln/detail/CVE-2020-14152)

So, considering the current security concerns across the world and especially taking into account that numerous USA companies are now obligated to provide SBOM document with each release, the outdated 3rd party libraries listed above should be upgraded to their latest versions to avoid the know vulnerability issues.
--- end body ---

The issue reports multiple vulnerabilities in third-party libraries used by Gpac, including known CVEs affecting madler-zlib, libpng, and libjpeg. These vulnerabilities could potentially be exploited if the libraries are not updated, posing a security risk to applications using Gpac.