Integer Overflow Vulnerability in GPAC MPEG-4 Decoding Library by GPAC Project
CVE-2021-21835

8.8HIGH

Key Information:

Vendor

Gpac

Status
Gpac Project
Vendor
CVE Published:
25 August 2021

What is CVE-2021-21835?

An exploitable integer overflow vulnerability is present within the MPEG-4 decoding functionality of the GPAC Project's Advanced Content library v1.0.1. This flaw could be triggered by a specially crafted MPEG-4 input when decoding the 'csgp' FOURCC atom. The vulnerability arises from unchecked arithmetic that leads to a heap-based buffer overflow, ultimately causing memory corruption. Attackers can exploit this vulnerability by convincing users to open a malicious video file, which could compromise system integrity.

Affected Version(s)

GPAC Project GPAC Project Advanced Content commit a8a8d412dabcb129e695c3e7d861fcc81f608304, GPAC Project Advanced Content v1.0.1

References

https://talosintelligence.com/vulnerability_reports/TALOS...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.