CVE-2021-21859

HIGH

GPAC 1.0.1 - Integer Truncation in MPEG-4 Atom Processing

Title source: llm

Description

An exploitable integer truncation vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. The stri_box_read function is used when processing atoms using the 'stri' FOURCC code. An attacker can convince a user to open a video to trigger this vulnerability.

References (2)

Core 2

Core References

Exploit, Third Party Advisory x_refsource_misc

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1298

Third Party Advisory vendor-advisory x_refsource_debian

https://www.debian.org/security/2021/dsa-4966

Scores

CVSS v3 8.8

EPSS 0.0160

EPSS Percentile 72.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-190 CWE-680

Status published

Products (2)

debian/debian_linux 11.0

gpac/gpac 1.0.1

Published Aug 16, 2021

Tracked Since Feb 18, 2026