CVE-2021-46237

What it actually does

Untrusted pointer dereference in gf_node_unregister at scenegraph/base_scenegraph.c allows memory corruption that crashes the process.

Why it matters to the business

Attackers can cause denial of service by supplying specially crafted input, leading to application or service outages; the issue affects widely used multimedia handling components with an available exploit and long public exposure window.

How an attack unfolds

An attacker crafts a malicious media file or scene graph input that triggers the vulnerable function during parsing; when the application processes the input the dereference occurs, corrupting memory and terminating the process. Public exploit code exists and the flaw has been known for over four years.

How to fix it

Upgrade envoyproxy/envoy to commit 9b1c3962172a972bc0359398af6daa3790bb59db or later; rebuild any dependent packages that embed the vulnerable GPAC code and test for continued crashes with known-bad inputs.

How to confirm the fix worked

Confirm the binary or library no longer contains the vulnerable gf_node_unregister implementation by checking the commit hash or version string; run regression tests with the original proof-of-concept input to verify the crash no longer occurs.

Typical attack path

1. Obtain or generate a malicious file or input stream targeting the scene graph parser
2. Deliver the input to the affected application (local file open or network delivery)
3. Trigger processing through gf_node_unregister
4. Cause untrusted pointer dereference resulting in crash

How to detect it

Review application crash logs and core dumps around the time of suspected incidents for segmentation faults originating in scenegraph or base_scenegraph code; correlate with file-processing events involving untrusted media.

What your security team should do

• Apply the listed commit or newer release immediately given the public exploit and 1733 days of exposure
• Inventory all builds that incorporate GPAC or envoy and schedule upgrades
• Add the vulnerable function and commit identifiers to code-scanning and dependency checks
• Monitor for new EPSS increases or KEV listing