CVE-2023-46931

What it actually does

Heap-buffer-overflow in ffdmx_parse_side_data during side data parsing allows memory corruption when processing crafted media files.

Why it matters to the business

Application crashes during media file handling can interrupt content creation, editing, and playback workflows that rely on the affected software.

How an attack unfolds

An attacker crafts a malicious media file containing malformed side data that triggers the overflow in the parsing routine when the file is opened locally with user interaction; low exploit maturity and stable low EPSS indicate limited observed in-the-wild use despite the 1080-day publication window.

How to fix it

Update to the latest GPAC release that resolves the buffer handling issue in ff_dmx.c; until a fix is available, process untrusted media files only in isolated environments.

How to confirm the fix worked

Test with known triggering media samples in a controlled setting and monitor process stability; review source changes around ffdmx_parse_side_data for bounds checking.

Typical attack path

1. Attacker generates a specially crafted media file targeting the side-data parser
2. Victim opens the file using an affected GPAC tool such as MP4Box
3. Overflow occurs in ffdmx_parse_side_data, corrupting heap memory and causing denial of service

How to detect it

Review application crash logs and core dumps for signs of heap corruption during media parsing; correlate file access timestamps with process terminations in environments using GPAC tools.

What your security team should do

• Prioritize sandboxing or replacement of GPAC usage for untrusted inputs given the three-year disclosure window
• Track upstream commits addressing the heap overflow in the demux filter
• Limit local execution of MP4Box and related tools to trusted file sources