Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.5
CVE-2021-40576: Gpac MP4Box Can Crash with Carefully Crafted MP4 Files
CVE-2021-40576 · published 4 years ago
Summary
The MP4Box tool in Gpac 1.0.1 can crash when processing a specially made MP4 file, potentially disrupting video playback. This issue affects users who rely on MP4Box for media processing. To protect your system, update to a newer version of Gpac that fixes this issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gpac | gpac |
1.0.1 cpe:2.3:a:gpac:gpac:1.0.1:*:*:*:*:*:*:* |
Original advisory text
The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.
The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.
References
- https://github.com/gpac/gpac/commit/ad18ece95fa064efc0995c4ab2c985f77fb166ec Patch Third Party Advisory
- https://github.com/gpac/gpac/issues/1904 Exploit Issue Tracking Third Party Advisory
- https://www.debian.org/security/2023/dsa-5411
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-476NULL Pointer Dereference
Timeline
Published13 Jan 2022
Updated4 Nov 2026
First seen11 Apr 2026
Track software like this
Free during beta