CVE-2022-47090
Published: 24 January 2025
Summary
CVE-2022-47090 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Deeper analysis
CVE-2022-47090 is a buffer overflow vulnerability affecting GPAC MP4Box version 2.1-DEV-rev574-g9d5bb184b. The flaw occurs in the gf_vvc_read_pps_bs_internal function within media_tools/av_parsers.c, where a missing check for num_exp_tile_columns allows the overflow. It is categorized under CWE-120 (Buffer Copy without Checking Size of Input) and received a CVSS v3.1 base score of 7.8.
The vulnerability can be exploited by a local attacker requiring low complexity and no privileges, though user interaction is necessary, such as processing a specially crafted file with MP4Box. Successful exploitation enables high confidentiality, integrity, and availability impacts, potentially allowing arbitrary code execution, data disclosure, or system disruption within the local scope.
A patch is available via a commit in the GPAC GitHub repository at https://github.com/gpac/gpac/commit/48760768611f6766bf9e7378bb7cc66cebd6e49d, which addresses the missing check. Additional details on the issue are documented in https://github.com/gpac/gpac/issues/2341. Practitioners should apply the patch or use an updated GPAC version to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-49866
Vulnerability details
GPAC MP4box 2.1-DEV-rev574-g9d5bb184b contains a buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c, check needed for num_exp_tile_columns
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in client-side media parser (MP4Box) directly enables arbitrary code execution via crafted file (T1203: Exploitation for Client Execution).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of the buffer overflow flaw in GPAC MP4Box via the available patch, directly eliminating the vulnerability.
Implements memory protections like ASLR and DEP to prevent arbitrary code execution from buffer overflow exploits in unpatched GPAC MP4Box.
Requires vulnerability scanning to identify and report the specific CVE-2022-47090 buffer overflow in GPAC MP4Box for remediation.