CVE-2023-0841 json
GPAC reframe_mp3.c mp3_dmx_process heap-based overflow
published 2023-02-15 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-12842
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.2%
- EPSS 1.2% chance of exploitation in 30 days, percentile 67%
- public exploits
- 0
- none known
Summary
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded. This issue affects the function mp3_dmx_process of the file filters/reframe_mp3.c. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221087.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
1.15% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/qianshuidewajueji/poc/blob/main/gpac/mp3_dmx_process_poc3 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected products
- n/a GPAC
- gpac gpac
Classification
References
- github.com /gpac/gpac/commit/851560e3dc8155d45ace4b0d77421f241ed71dc4
-
github.com
/qianshuidewajueji/poc/blob/main/gpac/mp3_dmx_process_poc3
exploit
-
vuldb.com
/?id.221087
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.221087
signature, permissions-required, third-party-advisory
- github.com /advisories/GHSA-w52x-cp47-xhhw
- github.com /gpac/gpac/releases/tag/v2.2.1
- github.com /gpac/gpac/issues/2396
Sources
- CVE List CVE-2023-0841
- NVD CVE-2023-0841
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.