CVE-2024-50664
Published: 23 January 2025
Summary
CVE-2024-50664 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Gpac Gpac. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 24.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the heap buffer overflow in GPAC/MP4Box by requiring timely patching of the specific flaw in gf_isom_new_mpha_description.
Provides memory protections like ASLR and DEP to prevent exploitation of the heap buffer overflow even if the GPAC vulnerability remains unpatched.
Requires validation of malformed MP4 file inputs to GPAC/MP4Box to block the out-of-bounds write triggered by untrusted multimedia data.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in local MP4Box client enables direct arbitrary code execution via crafted malicious file requiring user interaction.
NVD Description
gpac 2.4 contains a heap-buffer-overflow at isomedia/sample_descs.c:1799 in gf_isom_new_mpha_description in gpac/MP4Box.
Deeper analysisAI
CVE-2024-50664 is a heap buffer overflow vulnerability in GPAC version 2.4, an open-source multimedia framework. The flaw is located at isomedia/sample_descs.c:1799 in the function gf_isom_new_mpha_description within the gpac/MP4Box component. It is associated with CWE-787 (Out-of-bounds Write) and CWE-120 (Buffer Copy without Checking Size of Input).
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A local attacker with no privileges can exploit it by tricking a user into processing a malicious file with MP4Box, requiring user interaction. Successful exploitation enables high-impact consequences, including unauthorized access to sensitive data, modification of system integrity, and denial of service through potential arbitrary code execution.
Mitigation details and patches are discussed in the GitHub issue at https://github.com/gpac/gpac/issues/2988. Security practitioners should monitor this repository for updates and apply fixes promptly when available.
Details
- CWE(s)