CVE-2021-29279

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

There is a integer overflow in function filter_core/filter_props.c:gf_props_assign_value in GPAC 1.0.1. In which, the arg const GF_PropertyValue *value,maybe value->value.data.size is a negative number. In result, memcpy in gf_props_assign_value failed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190 CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gpac/gpac/commit/da69ad1f970a7e17c865eaec9af98cc84df10d5bPatch, Third Party Advisory
https://github.com/gpac/gpac/issues/1718Exploit, Third Party Advisory
https://github.com/gpac/gpac/commit/da69ad1f970a7e17c865eaec9af98cc84df10d5bPatch, Third Party Advisory
https://github.com/gpac/gpac/issues/1718Exploit, Third Party Advisory

Timeline

Published: Apr 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-292806.4In TP-Link Wireless N Router WR840N an ARP poisoning attack can cause buffer overflow CVE-2021-292819.8File upload vulnerability in GFI Mail Archiver versions up to and including 15.1 via insecure implementation of Telerik Web UI plugin which CVE-2021-292947.5Null Pointer Dereference vulnerability exists in D-Link DSL-2740R UK_1.01, which could let a remove malicious user cause a denial of service CVE-2021-292957.5Null Pointer Dereference vulnerability exists in D-Link DSP-W215 1.10, which could let a remote malicious user cause a denial of servie via CVE-2021-292967.5Null Pointer Dereference vulnerability in D-Link DIR-825 2.10b02, which could let a remote malicious user cause a denial of service. The vul CVE-2021-292975.3Buffer Overflow in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and application crash CVE-2021-292985.3Improper Input Validation in Emerson GE Automation Proficy Machine Edition v8.0 allows an attacker to cause a denial of service and applicat CVE-2021-293009.8The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute c CVE-2021-293028.1TP-Link TL-WR802N(US), Archer_C50v5_US v4_200 <= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message. CVE-2021-293136.1Cross Site Scripting (XSS) vulnerability exists in SeaCMS 12.6 via the (1) v_company and (2) v_tvs parameters in /admin_video.php,CVE-2021-293235.5OpenSource Moddable v10.5.0 was discovered to contain a heap buffer overflow via the component /modules/network/wifi/esp/modwifi.c.CVE-2021-293247.8OpenSource Moddable v10.5.0 was discovered to contain a stack overflow via the component /moddable/xs/sources/xsScript.c.