CVE-2021-21859

2021-08-1619:07:13

CWE-680

talos

www.cve.org

exploitable vulnerability

gpac project

mpeg-4 decoding

integer truncation

stri_box_read function

fourcc code

video

user

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.002

Percentile

61.1%

JSON

An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The stri_box_read function is used when processing atoms using the ‘stri’ FOURCC code. An attacker can convince a user to open a video to trigger this vulnerability.

CNA Affected

[
  {
    "product": "GPAC Project",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "GPAC Project Advanced Content commit a8a8d412dabcb129e695c3e7d861fcc81f608304, GPAC Project Advanced Content v1.0.1"
      }
    ]
  }
]