Vulnerability Spotlight: Multiple integer overflow vulnerabilities in GPAC Project on Advanced Content
Summary: Cisco Talos discovered multiple integer overflow vulnerabilities in the GPAC Project on Advanced Content, an open-source library implementing the MPEG-4 system standard, tracked as TALOS-2021-1297 through TALOS-2021-1299 and spanning CVE-2021-21834 through CVE-2021-21862. An adversary could send a target a specially crafted MPEG-4 input, triggering an integer overflow from unchecked addition arithmetic that results in a heap-based buffer overflow and memory corruption.
Why it matters: The attack path is a media file, so any pipeline that parses MPEG-4 content with GPAC is exposed to memory corruption from a single crafted input. Talos confirmed the affected versions and points users to commit a8a8d412dabcb129e695c3e7d861fcc81f608304 and version 1.0.1, with Snort rules 57607-57618, 57623-57630 and 57635-57672 available for detection.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-21834CVE-2021-21852CVE-2021-21853CVE-2021-21858CVE-2021-21859CVE-2021-21862
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026