CVE-2021-46311

What it actually does

NULL pointer dereference in gf_sg_destroy_routes at scenegraph/vrml_route.c causes immediate process crash on malformed VRML route handling.

Why it matters to the business

Media processing applications become unavailable when users open specially crafted scene files, leading to workflow interruptions and potential data loss during rendering or playback sessions.

How an attack unfolds

An attacker crafts a VRML file that reaches the route destruction path with a null pointer, triggering the dereference and DoS when the file is loaded by the vulnerable parser.

How to fix it

Upgrade GPAC to a build containing the fix for the route destruction path; apply the referenced semantic-release/semantic-release commit 58a226f29c04ee56bbb02cc661f020d568849cad equivalent patch if backporting is required.

How to confirm the fix worked

Confirm the installed GPAC binary reports a version after the route handling correction; attempt to load known trigger files in a controlled environment and verify no crash occurs.

Typical attack path

1. Create or obtain a malformed VRML scene containing invalid route definitions
2. Deliver the file to a target system running the affected GPAC build
3. Trigger loading or processing of the scene via local application or command line
4. Execute gf_sg_destroy_routes on the corrupted structure
5. Cause unhandled null dereference and application termination

How to detect it

Review application and system logs for sudden GPAC process terminations when handling scene files; correlate crashes with recent file access timestamps and check for any public exploit samples matching the route function signature.

What your security team should do

• Immediately inventory all GPAC deployments and schedule upgrades to the corrected build
• Restrict processing of untrusted VRML or scene graph files until patched
• Monitor for application crashes correlated with media file ingestion
• Test the fix in staging before production rollout