CVE-2022-26967: Buffer Overflow
Published Mar 12, 2022
·Updated
GPAC 2.0 allows a heap-based buffer overflow in gfbase64encode. It can be triggered via MP4Box.
Affected Software
2 affected componentsFixes available
debian/gpac<=0.5.2-426-gc5ad4e4+dfsg5-5
1.0.1+dfsg1-4+deb11u32.2.1+dfsg1-3
Gpac GPAC=2.0
Remediation
Patch Available
Event History
Mar 12, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is CVE-2022-26967?
CVE-2022-26967 is a vulnerability in GPAC 2.0 that allows a heap-based buffer overflow in gf_base64_encode, which can be triggered via MP4Box.
2
How severe is CVE-2022-26967?
CVE-2022-26967 is considered a critical vulnerability.
3
Which software versions are affected by CVE-2022-26967?
GPAC versions 0.5.2-426-gc5ad4e4+dfsg5-5, 1.0.1+dfsg1-4+deb11u1, and 2.0.0+dfsg1-4 are affected by CVE-2022-26967.
4
How can CVE-2022-26967 be exploited?
CVE-2022-26967 can be exploited by triggering a heap-based buffer overflow in gf_base64_encode, which can be done via MP4Box.
5
Is there a fix for CVE-2022-26967?
Yes, the remedy for CVE-2022-26967 is to update GPAC to version 1.0.1+dfsg1-4+deb11u3 or 2.0.0+dfsg1-4.