CVE-2021-36414

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A heab-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via media.c, which allows attackers to cause a denial of service or execute arbitrary code via a crafted file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/gpac/gpac/issues/1840Exploit, Issue Tracking, Patch, Third Party Advisory
https://www.debian.org/security/2023/dsa-5411
https://github.com/gpac/gpac/issues/1840Exploit, Issue Tracking, Patch, Third Party Advisory
https://www.debian.org/security/2023/dsa-5411

Timeline

Published: Jan 10, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-364177.8A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box, which causes a denial of CVE-2021-36425.3A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer ma CVE-2021-364249.8An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.CVE-2021-364255.4Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlin CVE-2021-364268.8File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general CVE-2021-36439.1A flaw was found in sox 14.4.1. The lsx_adpcm_init function within libsox leads to a global-buffer-overflow. This flaw allows an attacker to CVE-2021-364319.1SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_che CVE-2021-364327.5SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_mask CVE-2021-364339.1SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_delete_m CVE-2021-364349.1SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_che CVE-2021-364365.3An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via subm CVE-2021-364386.5SQL Injection vulnerability exists in Sourcecodester Online Job Portal phppdo 1.0 ivia the category parameter in /jobportal/index.php.