Double Free in Gpac

CVE-2023-1449

A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gf_av1_reset_state of the file media_tools/av_parsers.c. The manipulation leads to double free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223294 is the identifier assigned to this vulnerability.

Vulnerability class: Double Free

EPSS: 0.004 (29.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

  • Gpac — versions 2.3
  • N/a Gpac — versions 2.3-DEV-rev35-gbbca86917-master

Weakness classification (CWE)

References

  • cna@vuldb.com (technical-description, VDB Entry, Third Party Advisory, vdb-entry)
  • cna@vuldb.com (signature, Permissions Required, permissions-required, VDB Entry, Third Party Advisory)
  • cna@vuldb.com (issue-tracking, Exploit, Patch, Third Party Advisory, Issue Tracking)
  • cna@vuldb.com (Exploit, exploit)

Frequently asked questions

What is CVE-2023-1449?
CVE-2023-1449 is a medium-severity vulnerability in Gpac, classified under Double Free. CVSS score: 5.3/10. Published 2023-03-17.
How severe is CVE-2023-1449?
Medium severity. CVSS v3 base score is 5.3 out of 10.