What is CVE-2024-6063?

CVE-2024-6063 is a low-severity vulnerability in Gpac, classified under NULL Pointer Dereference. CVSS score: 3.3/10. Published 2024-06-17.

How severe is CVE-2024-6063?

Low severity. CVSS v3 base score is 3.3 out of 10.

Is CVE-2024-6063 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

NULL pointer dereference in Gpac

CVE-2024-6063

A vulnerability was found in GPAC 2.5-DEV-rev228-g11067ea92-master. It has been classified as problematic. This affects the function m2tsdmx_on_event of the file src/filters/dmx_m2ts.c of the component MP4Box. The manipulation leads to null pointer dereference. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8767ed0a77c4b02287db3723e92c2169f67c85d5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-268791.

Published 2024-06-17 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

EPSS: 0.003 (23.4th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 23rd percentile — 23.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000

Affected products

Gpac — versions 2.5-dev-rev288-g11067ea92-master
Gpac — versions 2.5-DEV-rev228-g11067ea92-master

Weakness classification (CWE)

CWE-476 — NULL Pointer Dereference

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

vuldb.com/ (Permissions Required, technical-description, vdb-entry)
vuldb.com/ (signature, Permissions Required, permissions-required)
vuldb.com/ (Third Party Advisory, third-party-advisory)
github.com/gpac/gpac/issues/2873 (issue-tracking, Exploit, Third Party Advisory)
github.com/user-attachments/files/15801157/poc.zip (exploit, broken-link, Broken Link)
github.com/gpac/gpac/commit/8767ed0a77c4b02287db3723e92c2169f67c85d5 (Patch, patch)

Frequently asked questions

What is CVE-2024-6063?: CVE-2024-6063 is a low-severity vulnerability in Gpac, classified under NULL Pointer Dereference. CVSS score: 3.3/10. Published 2024-06-17.
How severe is CVE-2024-6063?: Low severity. CVSS v3 base score is 3.3 out of 10.
Is CVE-2024-6063 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.