CVE-2021-46238

What it actually does

Stack-based buffer overflow in gf_node_get_name during scene graph parsing causes out-of-bounds writes on the stack and immediate process termination.

Why it matters to the business

Media processing pipelines and tools that rely on GPAC can be forced offline by a single crafted file, interrupting content creation, transcoding, or playback workflows with no data loss but clear downtime.

How an attack unfolds

An attacker creates a specially malformed scene graph or MP4 container that supplies an oversized name string to gf_node_get_name; when a victim opens the file locally with GPAC the overflow occurs and the application crashes, achieving denial of service. Public exploit code is available.

How to fix it

Upgrade GPAC to the first version containing the fix for this stack overflow (post-1.1.0) or replace GPAC with an unaffected media library. Until upgraded, restrict GPAC to trusted files only.

How to confirm the fix worked

Confirm GPAC version is newer than 1.1.0, then attempt to open the original proof-of-concept file and verify the process no longer crashes.

Typical attack path

1. Attacker crafts malicious media file containing oversized node name
2. Victim opens the file with vulnerable GPAC binary
3. gf_node_get_name is invoked during scene graph construction
4. Stack overflow triggers and process terminates

How to detect it

Review system and application logs for abrupt GPAC terminations or segmentation faults when processing media files; correlate with file creation or download events immediately preceding the crash.

What your security team should do

• Inventory all systems running GPAC and prioritize upgrade to a fixed release
• Block or sandbox untrusted media files from being processed by GPAC until patched
• Add GPAC crash telemetry to monitoring to detect future similar issues