Gpac v2.2.1 vulnerable to Use-After-Free (UAF) via dasher_configure_pid function
CVE-2024-24266

7.5HIGH

Key Information:

Vendor

gpac

Status
Gpac
Vendor
CVE Published:
5 February 2024

What is CVE-2024-24266?

The GPAC software version 2.2.1 has been identified to contain a Use-After-Free (UAF) vulnerability particularly triggered through the function dasher_configure_pid located at /src/filters/dasher.c. This flaw can potentially allow attackers to execute arbitrary code or disrupt service, making it essential for users to apply necessary patches and updates to secure their systems against exploitation.

References

https://github.com/yinluming13579/gpac_defects/blob/main/...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.