CVE-2023-46929 Denial of service in n/a
Attackers can crash the GPAC MP4Box application via a flaw in AVC VUI parsing, affecting users of the multimedia library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-46929?
CVE-2023-46929 is a high-severity denial of service vulnerability in Gpac Gpac, published on 3 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:55 allows attackers to crash the application.
Weakness: CWE-20
Which versions are affected by CVE-2023-46929?
It affects 1 product.
Products include Gpac Gpac.
How do I fix CVE-2023-46929?
No fix has been published for CVE-2023-46929 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-46929 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-46929 exists.
Other vulnerabilities in Gpac Gpac
Sources
Also known as GHSA-phvj-2xc5-g994, UBUNTU-CVE-2023-46929.