CVE-2023-46427 Null dereference in n/a

Critical 9.8 Published 9 Mar 2024 Updated 28 Aug 2024

Remote attackers can execute arbitrary code, cause denial of service, or read sensitive information via a null pointer dereference in GPAC.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-46427?

CVE-2023-46427 is a critical vulnerability in Gpac Gpac, published on 9 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), and obtain sensitive information via null pointer deference in gf_dash_setup_period component in media_tools/dash_client.c.

Weakness: CWE-476

Which versions are affected by CVE-2023-46427?

It affects 1 product.

Products include Gpac Gpac.

How do I fix CVE-2023-46427?

No fix has been published for CVE-2023-46427 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-46427 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46427 exists.

All Gpac Gpac vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-46427, GHSA-q8g7-2p5j-49jv, UBUNTU-CVE-2023-46427.