What’s Vulnerable › Vulnerabilities

CVE-2022-29340

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-05-05 · updated 2026-06-17
• Weakness: CWE-476

Description

GPAC 2.1-DEV-rev87-g053aae8-master. has a Null Pointer Dereference vulnerability in gf_isom_parse_movie_boxes_internal due to improper return value handling of GF_SKIP_BOX, which causes a Denial of Service. This vulnerability was fixed in commit 37592ad.

Affected products

• GPAC: before 2022-04-12 — fixed in 2022-04-12

How to fix

Upgrade to a fixed version: GPAC 2022-04-12. Check the vendor advisory for mitigations.

References

• https://github.com/gpac/gpac/commit/37592ad86c6ca934d34740012213e467acc4a3b0
• https://github.com/gpac/gpac/issues/2163
• https://github.com/gpac/gpac/commit/37592ad86c6ca934d34740012213e467acc4a3b0
• https://github.com/gpac/gpac/issues/2163

Get alerted when CVE-2022-29340 or the next vulnerability affects your stack