Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.3-DEV.
The vulnerability consists of a stack-based buffer overflow in the GPAC repository. Writing data beyond the boundaries of an allocated buffer (CWE-787 ā out-of-bounds write) can lead to overwriting critical stack control structures, such as the function return address. The attack vector is network-based, requires no privileges or user interaction, making it exceptionally easy to exploit.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code remotely (RCE) in the context of the application process, and consequently gain full control over the system, including violation of confidentiality, integrity, and availability of data.
GPAC should be updated to version 2.3-DEV or newer. The patch is available in commit d0ced41651b279bb054eb6390751e2d4eb84819a in the official GPAC project GitHub repository.
GPAC in versions prior to 2.3-DEV (gpac/gpac repository on GitHub)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HGpac
APPGpac< 2.3.0-dev
Related vulnerabilities
GPAC: null pointer dereference w gf_dash_setup_period umożliwia RCE i DoS
Out-of-bounds Read w bibliotece GPAC ā odczyt pamiÄci i awaria aplikacji
Heap Buffer Overflow w GPAC/MP4Box ā RCE i DoS przez klasÄ str2ulong
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2.
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.