CVE-2021-46239

What it actually does

Invalid free via gf_free() in utils/alloc.c allowing memory corruption that results in denial of service.

Why it matters to the business

Service or application crashes disrupt availability for users processing media files; low exploit probability but requires prompt patching of the affected envoyproxy/envoy commit lineage.

How an attack unfolds

An attacker supplies a specially crafted MP4 file that triggers the invalid free inside MP4Box processing; when the binary is invoked locally or through an affected pipeline the corruption leads to a crash without further code execution.

How to fix it

Upgrade envoyproxy/envoy to commit 7ffda4e809dec74449ebc330cebb9d2f4ab61360 or later; rebuild any downstream images or packages that embed the vulnerable GPAC-derived binary.

How to confirm the fix worked

Confirm the running binary reports the fixed commit hash; re-test with the original crashing MP4 sample and verify no crash or memory error occurs.

Typical attack path

1. Craft malicious MP4 input designed to reach the vulnerable allocation path
2. Invoke MP4Box (or dependent envoy processing) on the crafted file
3. Trigger gf_free() on an already-freed or invalid pointer
4. Cause process termination resulting in denial of service

How to detect it

Review application or system logs for unexpected crashes during MP4Box or media-processing invocations; inspect core dumps or sanitizer reports indicating invalid free at alloc.c.

What your security team should do

• Apply the fixed commit immediately given public exploit availability
• Scan build pipelines and container images for the vulnerable GPAC version
• Monitor EPSS trend and any new exploit code for increased urgency