CVE-2021-21855: Buffer Overflow
Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input can cause an integer overflow due to unchecked addition arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-21855?
CVE-2021-21855 has been classified as a high severity vulnerability due to the potential for exploitation leading to a heap-based buffer overflow.
How do I fix CVE-2021-21855?
To mitigate CVE-2021-21855, users should upgrade GPAC to versions 0.5.2-426-gc5ad4e4+dfsg5-5, 1.0.1+dfsg1-4+deb11u3, or 2.2.1+dfsg1-3.
What are the affected versions for CVE-2021-21855?
CVE-2021-21855 affects GPAC version 1.0.1 and potentially versions prior to 2.2.1.
What type of vulnerability is CVE-2021-21855?
CVE-2021-21855 is an integer overflow vulnerability that can lead to a heap-based buffer overflow during MPEG-4 decoding.
Is CVE-2021-21855 exploitable remotely?
Yes, CVE-2021-21855 can be exploited by an attacker remotely through specially crafted MPEG-4 files.