Medium
Security advisory
Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-33361
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:43 UTC · Revision 1
Source evidence
Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.
osv:CVE-2021-33361
Complete source record
{
"id": "73937b26d03eea693b80343502322e13da0e476fe9bed04d2d93b32dd33a99b0",
"url": "https://osv.dev/vulnerability/CVE-2021-33361",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-33361",
"summary": "Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allows attackers to read memory via a crafted file.",
"evidence": "osv:CVE-2021-33361",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-33361",
"aliases": [
"CVE-2021-33361"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gpac/gpac",
"type": "GIT",
"events": [
{
"introduced": "d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"
},
{
"last_affected": "d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"
},
{
"fixed": "a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gpac:gpac:1.0.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.1"
},
{
"last_affected": "1.0.1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.0.1",
"v1.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-33361.json",
"vanir_signatures": [
{
"id": "CVE-2021-33361-2a794e70",
"digest": {
"threshold": 0.9,
"line_hashes": [
"173257933732895657791454856072550826614",
"335272942177535874662589193357733262801",
"325158472612267962414184621803428462934",
"251320005709277231234078755258523288097",
"288378636506204222685295060043339577644",
"336729436209302758293688035213458080050",
"78358940734272799868297090819371091041",
"309287822199362503481384769860411503329",
"256896105000039859550390821306006879784",
"33365563588096817325450385196559786397",
"18803994370916686041898023545193148103",
"104951466860376530318190474253865623106",
"83226274969225481578923699586586262345",
"162590810915219860779888630376840113288",
"165543997710540366462314263695688073375",
"215383182475346542705963808831546610224"
]
},
"source": "https://github.com/gpac/gpac/commit/a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f",
"target": {
"file": "src/isomedia/box_code_adobe.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-33361-526fa629",
"digest": {
"length": 2834,
"function_hash": "73015870715061305347187311939351552826"
},
"source": "https://github.com/gpac/gpac/commit/a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f",
"target": {
"file": "applications/mp4box/main.c",
"function": "mp4box_cleanup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-33361-b22a6461",
"digest": {
"length": 1876,
"function_hash": "122312135528555279617764607133896215776"
},
"source": "https://github.com/gpac/gpac/commit/a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f",
"target": {
"file": "src/isomedia/box_code_adobe.c",
"function": "afra_box_read"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-33361-b9b19e16",
"digest": {
"threshold": 0.9,
"line_hashes": [
"44677966355079213415483734452131210546",
"277717650748245688562838150451199775608",
"164442005580115004913675099071449988250",
"313641165189259567567760258612648201704"
]
},
"source": "https://github.com/gpac/gpac/commit/a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f",
"target": {
"file": "applications/mp4box/main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:23:27Z"
}
}
],
"modified": "2026-10-20T14:23:27.287496778Z",
"provider": "osv",
"references": [
"https://www.debian.org/security/2023/dsa-5411",
"https://github.com/gpac/gpac/commit/a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f",
"https://github.com/gpac/gpac/issues/1782"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-33361",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388866,
"published_at": "2021-09-13T20:15:08.51+00:00"
}