Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-6062: GPAC MP4Box Null Pointer Dereference in Local File Handling

CVE-2024-6062 · published 2 years ago

Summary

A security issue exists in the MP4Box component of GPAC, which can cause the program to crash when trying to read a specific type of file. This issue can be exploited by an attacker with local access to the system, and a patch is available to fix the problem. To protect against this issue, update the GPAC software to the patched version.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gpac	gpac	2.5-dev-rev288-g11067ea92-master `cpe:2.3:a:gpac:gpac:2.5-dev-rev288-g11067ea92-master:::::::*`

Original advisory text

GPAC MP4Box load_text.c swf_svg_add_iso_sample null pointer dereference

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this issue is the function swf_svg_add_iso_sample of the file src/filters/load_text.c of the component MP4Box. The manipulation leads to null pointer dereference. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 31e499d310a48bd17c8b055a0bfe0fe35887a7cd. It is recommended to apply a patch to fix this issue. VDB-268790 is the identifier assigned to this vulnerability.

References

https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6062.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-6062 Vendor Advisory
https://vuldb.com/?id.268790 Vendor Advisory
https://vuldb.com/?submit.356314 Vendor Advisory
https://github.com/gpac/gpac/issues/2872 Third Party Advisory
https://vuldb.com/?ctiid.268790 Third Party Advisory
https://github.com/gpac/gpac/commit/31e499d310a48bd17c8b055a0bfe0fe35887a7cd Patch
https://github.com/user-attachments/files/15801126/poc2.zip Exploit

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published17 Jun 2024

Updated4 Nov 2026

First seen12 Apr 2026

Sources

CVE-2024-6062 · OSV

CVE-2024-6062 · NVD

Track software like this

Free during beta