{"id":"CVE-2021-21847","aliases":["DEBIAN-CVE-2021-21847","DSA-4966-1","EUVD-2021-9018","GHSA-qjc4-ggf7-jc8j","MGASA-2021-0431","UBUNTU-CVE-2021-21847"],"status":"published","title":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding...","description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01963,"percentile":0.80484,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-190","CWE-680"],"published":"2021-08-18T12:25:31Z","modified":"2026-10-24T10:30:38Z","fixes":[{"ecosystem":"Debian:11","package":"gpac","fixed_in":["1.0.1+dfsg1-4+deb11u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+dfsg1-4+deb11u1"}]}],"versions":["1.0.1+dfsg1-4"]},{"source":"osv","ecosystem":"Debian:11","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1+dfsg1-4+deb11u1"}]}],"versions":["1.0.1+dfsg1-4"],"bundled":24},{"source":"osv","ecosystem":"Mageia:8","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-1.1.mga8.tainted"}]}],"bundled":24},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.0+svn4288~dfsg1-1ubuntu1","0.5.0+svn4288~dfsg1-4","0.5.0+svn4288~dfsg1-4ubuntu1","0.5.0+svn4288~dfsg1-4ubuntu1+esm1","0.5.0+svn4288~dfsg1-4ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.2-426-gc5ad4e4+dfsg5-1build1","0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1","0.5.2-426-gc5ad4e4+dfsg5-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.2-426-gc5ad4e4+dfsg5-3","0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1","0.5.2-426-gc5ad4e4+dfsg5-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.2-426-gc5ad4e4+dfsg5-4ubuntu1","0.5.2-426-gc5ad4e4+dfsg5-5","0.5.2-426-gc5ad4e4+dfsg5-5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.1+dfsg1-4","1.0.1+dfsg1-5","2.0.0+dfsg1-2","2.0.0+dfsg1-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gpac","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.1+dfsg1-3","2.2.1+dfsg1-3.1","2.2.1+dfsg1-3.1build1","2.2.1+dfsg1-3.1build2","2.2.1+dfsg1-3.1ubuntu0.1~esm2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gpac","product":"gpac"}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","report"]},{"url":"https://www.debian.org/security/2021/dsa-4966","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1297","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21847"},{"url":"https://github.com/advisories/GHSA-qjc4-ggf7-jc8j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-21847","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0431.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29432","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-21847","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-21847","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-21847","description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","status":"published","published":"2021-08-18T12:25:31Z","modified":"2024-08-03T18:23:29.614Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-680"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-9018","description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","status":"published","published":"2021-08-18T12:25:31Z","modified":"2024-08-03T18:23:29Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:25:04.672228Z"}],"ghsa":[{"id":"GHSA-qjc4-ggf7-jc8j","title":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding...","description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","status":"published","published":"2022-05-24T22:28:54Z","modified":"2023-01-27T05:04:37Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119","CWE-190"],"updated_at":"2026-11-02T14:42:30.494485Z"}],"nvd":[{"id":"CVE-2021-21847","description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","status":"published","published":"2021-08-18T13:15:07.813Z","modified":"2026-06-17T03:36:13.627Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-680","CWE-119"],"updated_at":"2026-11-02T14:06:57.318236Z"}],"osv":[{"id":"CVE-2021-21847","description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","status":"published","published":"2021-08-18T13:15:07.813Z","modified":"2026-10-24T10:30:38.029368272Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-21847","description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","status":"published","published":"2021-08-18T13:15:07.813Z","modified":"2026-08-27T23:03:59.045739527Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"UBUNTU-CVE-2021-21847","description":"Multiple exploitable integer overflow vulnerabilities exist within the MPEG-4 decoding functionality of the GPAC Project on Advanced Content library v1.0.1. A specially crafted MPEG-4 input in “stts” decoder can cause an integer overflow due to unchecked arithmetic resulting in a heap-based buffer overflow that causes memory corruption. An attacker can convince a user to open a video to trigger this vulnerability.","status":"published","published":"2021-08-18T13:15:00Z","modified":"2026-04-22T12:47:25.514944Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"DSA-4966-1","title":"gpac - security update","status":"published","published":"2021-08-31T00:00:00Z","modified":"2026-03-09T02:09:58.727024Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0431","title":"Updated gpac packages fix security vulnerability","description":"A specially crafted MPEG-4 input when decoding the atom for the \"co64\" \nFOURCC can cause an integer overflow due to unchecked arithmetic resulting\nin a heap-based buffer overflow that causes memory corruption. (CVE-2021-21834)\n\nA specially crafted MPEG-4 input using the \"ctts\" FOURCC code can cause\nan integer overflow due to unchecked arithmetic resulting in a\nheap-based buffer overflow that causes memory corruption. (CVE-2021-21836)\n\nA specially crafted MPEG-4 input can cause an integer overflow due to\nunchecked arithmetic resulting in a heap-based buffer overflow that\ncauses memory corruption. (CVE-2021-21837, CVE-2021-21838, CVE-2021-21839)\n\nA specially crafted MPEG-4 input used to process an atom using the \"saio\"\nFOURCC code cause an integer overflow due to unchecked arithmetic\nresulting in a heap-based buffer overflow that causes memory corruption.\n(CVE-2021-21840)\n\nA specially crafted MPEG-4 input when reading an atom using the 'sbgp'\nFOURCC code can cause an integer overflow due to unchecked arithmetic\nresulting in a heap-based buffer overflow that causes memory corruption.\n(CVE-2021-21841)\n\nA specially crafted MPEG-4 input can cause an integer overflow when\nprocessing an atom using the 'ssix' FOURCC code, due to unchecked\narithmetic resulting in a heap-based buffer overflow that causes memory\ncorruption. (CVE-2021-21842)\n\nA specially crafted MPEG-4 input can cause an integer overflow due to\nunchecked arithmetic resulting in a heap-based buffer overflow that\ncauses memory corruption. After validating the number of ranges, at [41]\nthe library will multiply the count by the size of the\nGF_SubsegmentRangeInfo structure. On a 32-bit platform, this\nmultiplication can result in an integer overflow causing the space of the\narray being allocated to be less than expected. (CVE-2021-21843)\n\nA specially crafted MPEG-4 input when encountering an atom using the\n\"stco\" FOURCC code, can cause an integer overflow due to unchecked\narithmetic resulting in a heap-based buffer overflow that causes memory\ncorruption. (CVE-2021-21844)\n\nA specially crafted MPEG-4 input in \"stsc\" decoder can cause an integer\noverflow due to unchecked arithmetic resulting in a heap-based buffer\noverflow that causes memory corruption. (CVE-2021-21845)\n\nA specially crafted MPEG-4 input in \"stsz\u0026\" decoder can cause an integer\noverflow due to unchecked arithmetic resulting in a heap-based buffer\noverflow that causes memory corruption. (CVE-2021-21846)\n\nA specially crafted MPEG-4 input in \"stts\" decoder can cause an integer\noverflow due to unchecked arithmetic resulting in a heap-based buffer\noverflow that causes memory corruption. (CVE-2021-21847)\n\nThe library will actually reuse the parser for atoms with the \"stsz\"\nFOURCC code when parsing atoms that use the \"stz2\" FOURCC code and can\ncause an integer overflow due to unchecked arithmetic resulting in a\nheap-based buffer overflow that causes memory corruption.\n(CVE-2021-21848)\n\nA specially crafted MPEG-4 input can cause an integer overflow when the\nlibrary encounters an atom using the \"tfra\" FOURCC code due to unchecked\narithmetic resulting in a heap-based buffer overflow that causes memory\ncorruption. (CVE-2021-21849)\n\nA specially crafted MPEG-4 input can cause an integer overflow when the\nlibrary encounters an atom using the \"trun\" FOURCC code due to unchecked\narithmetic resulting in a heap-based buffer overflow that causes memory\ncorruption. (CVE-2021-21850)\n\nA specially crafted MPEG-4 input can cause an integer overflow due to\nunchecked addition arithmetic resulting in a heap-based buffer overflow\nthat causes memory corruption. (CVE-2021-21853, CVE-2021-21854,\nCVE-2021-21855, CVE-2021-21857, CVE-2021-21858)\n\nThe stri_box_read function is used when processing atoms using the 'stri'\nFOURCC code. (CVE-2021-21859)\n\nA specially crafted MPEG-4 input can cause an improper memory allocation\nresulting in a heap-based buffer overflow that causes memory corruption.\nThe FOURCC code, 'trik', is parsed by the function within the library.\n(CVE-2021-21860)\n\nWhen processing the 'hdlr' FOURCC code, a specially crafted MPEG-4 input\ncan cause an improper memory allocation resulting in a heap-based buffer\noverflow that causes memory corruption. (CVE-2021-21861)\n","status":"published","published":"2021-09-23T04:49:29Z","modified":"2026-04-16T04:44:31.858553866Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}