Buffer Overflow in GPAC MP4box Media Parser by GPAC
CVE-2022-47090

7.8HIGH

Key Information:

Vendor

GPAC

Status
MP4box
Vendor
CVE Published:
24 January 2025

What is CVE-2022-47090?

The GPAC MP4box software suffers from a buffer overflow vulnerability in the gf_vvc_read_pps_bs_internal function, located in media_tools/av_parsers.c. This vulnerability arises when the function does not adequately check the num_exp_tile_columns, leading to potential exploitation risks that could compromise system integrity and data security.

References

https://github.com/gpac/gpac/issues/2341
https://github.com/gpac/gpac/commit/48760768611f6766bf9e7...

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.