CVE-2023-48011

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments.c.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
gpac	gpac	2.3-dev-rev566-g50c2ab06f-master

References

https://github.com/gpac/gpac/commit/c70f49dda4946d6db6aa55588f6a756b76bd84eaPatch
https://github.com/gpac/gpac/issues/2611Exploit, Issue Tracking
https://github.com/gpac/gpac/commit/c70f49dda4946d6db6aa55588f6a756b76bd84eaPatch
https://github.com/gpac/gpac/issues/2611Exploit, Issue Tracking

Timeline

Published: Nov 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-480137.8GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core CVE-2023-480147.8GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/CVE-2023-480167.5Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter.CVE-2023-480178.8Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management.CVE-2023-48024.8A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web c CVE-2023-480208.8Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus.CVE-2023-480218.8Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update.CVE-2023-480229.8Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is t CVE-2023-480239.1Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in CVE-2023-480246.5Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hash_destroy(hash_table_t *h) at hash.c CVE-2023-480258.1Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.CVE-2023-480289.8kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify