CVE-2021-46313

What it actually does

The flaw triggers a segmentation fault inside __memmove_avx_unaligned_erms during MP4Box processing of specially crafted input, causing the binary to crash.

Why it matters to the business

Applications that rely on GPAC for media packaging or inspection can be interrupted, leading to workflow outages when untrusted files are handled.

How an attack unfolds

An attacker supplies a malicious MP4 file to the MP4Box binary; when the tool attempts to process the file, the unaligned memory operation faults and the process terminates.

How to fix it

Upgrade GPAC to the latest available release that resolves the crash; where upgrades are not feasible, isolate MP4Box execution or avoid processing untrusted media with the affected binary.

How to confirm the fix worked

Confirm the installed GPAC version is newer than 1.0.1 and re-test with known crashing samples to verify absence of the segmentation fault.

Typical attack path

1. Obtain or craft an MP4 file that triggers the fault condition
2. Invoke MP4Box on the file (locally or via automated pipeline)
3. Observe segmentation fault and resulting denial of service

How to detect it

Review system and application logs for segmentation-fault entries containing MP4Box or the memmove symbol; correlate with file-processing job failures.

• MP4Box
• __memmove_avx_unaligned_erms
• segmentation fault

What your security team should do

• Prioritize patching GPAC installations that expose MP4Box to external input
• Apply sandboxing or container isolation around media-processing tools
• Monitor upstream GPAC releases for the corrective patch