High severity · published Aug 25, 2021
CVE-2021-21848
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1
8.8
CVSS
1.7%
EPSS
No
On KEV
Description
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The library will actually reuse the parser for atoms with the “stsz” FOURCC code when parsing atoms that use the “stz2” FOURCC code and can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GP
GPAC Project ·
GPAC Project Advanced Content commit a8a8d412dabcb129e695c3e7d861fcc81f608304,GPAC Project Advanced Content v1.0.1 · source: vendor
DL
Debian Linux · Debian
10.0; 11.0 · source: NVD
GP
Gpac · Gpac
1.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21848
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21848
Exploit
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
Third Party Advisory
https://www.debian.org/security/2021/dsa-4966
More from GPAC Project
8.8
CVE-2021-21850
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1
8.8
CVE-2021-21849
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1
8.8
CVE-2021-21841
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1
8.8
CVE-2021-21842
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1
8.8
CVE-2021-21840
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1