Vulnerability identifier: #VU11086

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-1000100

CWE-ID: CWE-787

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
GPAC
Client/Desktop applications / Multimedia software

Vendor: GPAC

Description
The vulnerability allows an adjacent attacker to execute arbitrary code on the target system.

The weakness exists in the av_ext.c source code file due to the improper handling of crafted media files. An adjacent attacker can submit a specially crafted media file or trick the victim into opening a specially crafted media file, trigger out-of-bounds heap write and execute arbitrary code.

Mitigation
Install update from vendor's website.

Vulnerable software versions

GPAC: 0.7.0 - 0.7.1

---

CPE

• cpe:2.3:a:gpac:gpac:0.7.0:*:*:*:*:*:*:*

External links
http://github.com/gpac/gpac/issues/994

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?