CVE-2023-1449 GPAC av_parsers.c gf_av1_reset_state double free
A double free vulnerability in GPAC's AV1 parser allows local attackers to cause denial of service or potentially execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-1449?
CVE-2023-1449 is a medium-severity use after free vulnerability in Gpac Gpac, published on 17 Mar 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been found in GPAC 2.3-DEV-rev35-gbbca86917-master and classified as problematic. This vulnerability affects the function gf_av1_reset_state of the file media_tools/av_parsers.c. The manipulation leads to double free. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-223294 is the identifier assigned to this vulnerability.
Weakness: CWE-415
Which versions are affected by CVE-2023-1449?
It affects 1 product.
Products include Gpac Gpac.
How do I fix CVE-2023-1449?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2023-1449 being exploited?
There is no known exploitation of CVE-2023-1449 in the wild and no public exploit code.
Other vulnerabilities in Gpac Gpac
Sources
Also known as DEBIAN-CVE-2023-1449, GHSA-x2w5-7p4r-gxpq, UBUNTU-CVE-2023-1449.