Medium
Security advisory
An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media_tools/mpegts.c that can cause a denial of service (DOS) via a crafted MP4 file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-24829
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:38 UTC · Revision 1
Source evidence
An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media_tools/mpegts.c that can cause a denial of service (DOS) via a crafted MP4 file.
osv:CVE-2020-24829
Complete source record
{
"id": "099e82ae90cf55867abda3bf0d9dcbcd929001650f8aee87a112f95e45ee7562",
"url": "https://osv.dev/vulnerability/CVE-2020-24829",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-24829",
"summary": "An issue was discovered in GPAC from v0.5.2 to v0.8.0, as demonstrated by MP4Box. It contains a heap-based buffer overflow in gf_m2ts_section_complete in media_tools/mpegts.c that can cause a denial of service (DOS) via a crafted MP4 file.",
"evidence": "osv:CVE-2020-24829",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-24829",
"aliases": [
"CVE-2020-24829"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gpac/gpac",
"type": "GIT",
"events": [
{
"introduced": "cb0a053f47173556f193c2d996262d8c6aaac9bb"
},
{
"last_affected": "6b4ab401297be43b57f9eddd675971a8a5feab44"
},
{
"fixed": "8c5e847185d74462d674ee7d28fb46c29dae6dd2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.5.2"
},
{
"last_affected": "0.8.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "8c5e847185d74462d674ee7d28fb46c29dae6dd2"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v0.8.0",
"v0.7.1",
"v0.7.0",
"v0.6.0",
"v0.5.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24829.json",
"vanir_signatures": [
{
"id": "CVE-2020-24829-2afa7499",
"digest": {
"threshold": 0.9,
"line_hashes": [
"215271800634921823914992885678562486548",
"91704152373076633441726477168450822933",
"127975381763507671810302185192248256400",
"317463472625133151002432441653892377813",
"238494476529090314200448814672137605735",
"190437262437474021258278374935288872373",
"47041910215715421546396597527128316892",
"197008897461239487184549638065466810830",
"313806358128631219399359623752176024806",
"229575560135653573569764680330539429243",
"142515023052471893214721043216429990728",
"197008897461239487184549638065466810830",
"165219773958522982149325378183116107286",
"297678289269673202192143842985296264974",
"26453523544578143065306647949815387770",
"26686198762745249688243879800254485725",
"168462884946522520626609744835262128233"
]
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "applications/mp4box/main.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-2f855a30",
"digest": {
"length": 257,
"function_hash": "103628160776870297304187077697921558438"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c",
"function": "gf_m2ts_get_section_length"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-3489d10e",
"digest": {
"length": 2095,
"function_hash": "180039532483426121619801958246582003594"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c",
"function": "gf_m2ts_demux_del"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-57185872",
"digest": {
"length": 4388,
"function_hash": "110553909648997816319781855132051754685"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c",
"function": "gf_m2ts_get_adaptation_field"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-5a4e0330",
"digest": {
"length": 2137,
"function_hash": "158826145281828042582258932152234723370"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c",
"function": "gf_m2ts_process_pat"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-68917eeb",
"digest": {
"length": 12957,
"function_hash": "160650652517842896022163221044207719562"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c",
"function": "gf_m2ts_process_pmt"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-6dc093e4",
"digest": {
"length": 53273,
"function_hash": "283270996306476393876214736821991690193"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "applications/mp4box/main.c",
"function": "mp4boxMain"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-8965df0e",
"digest": {
"length": 1999,
"function_hash": "292415745383921450766174574624130007639"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c",
"function": "gf_m2ts_reframe_mpeg_video"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-992957e3",
"digest": {
"length": 1003,
"function_hash": "280379205579045700597035513552795448465"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/av_parsers.c",
"function": "gf_mp3_get_next_header_mem"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-a2d8bdb0",
"digest": {
"length": 6613,
"function_hash": "152747667381894918479047168528434163801"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c",
"function": "gf_m2ts_section_complete"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-a4945fb9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"190158671671625243414591564420307614887",
"117889428069973424003276404328852496421",
"225696714652218117502207525037287910312",
"104092498708241250721249041105698664383"
]
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/av_parsers.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-a9f906df",
"digest": {
"length": 987,
"function_hash": "154474446897750830253462805338440976271"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/isomedia/isom_write.c",
"function": "gf_isom_new_mpeg4_description"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-c09f4324",
"digest": {
"threshold": 0.9,
"line_hashes": [
"255645473099564956598546073874040577871",
"105059811658078635044347151374338058283",
"315245057240905541808445726412781412860",
"59206108003543468572067658191349193712",
"49262330707685635449416300113340537147"
]
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/isomedia/isom_write.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-d3e08327",
"digest": {
"length": 1287,
"function_hash": "263522201649715193512357314048577735051"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c",
"function": "gf_m2ts_pes_header"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-e7e942ab",
"digest": {
"threshold": 0.9,
"line_hashes": [
"233555553547748079518251295332126428804",
"233320010904768881464476481878425652671",
"191093796998333402101200209749085644073",
"159168320278433694209316875400918579021",
"7146164353436058246094727431145469483",
"289606309378441791880344086972240867735",
"257498891637826873270524902048006605258",
"223449348764947881838148764492956196235"
]
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/odf/odf_code.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-f135eb13",
"digest": {
"threshold": 0.9,
"line_hashes": [
"314151966595974561366148358061210981857",
"310943886852940165738680195998187100185",
"161265028163986242821099669706499319968",
"266609775963388190298994679687607220553",
"70492844613735905944064195415024551700",
"72925196837817785262911455871693332116",
"3333983184150570614231987409404563738",
"297199415174362606352771082399168924593",
"127064506595615773499236347926580347600",
"78569537489912384064818377251501250913",
"18450412433443245538182443034085877489",
"47234168541560354494898216264611076601",
"108985505237347333799304759588138701606",
"245671892664926975603404674764120809232",
"93907762560853748613284591357311080369",
"211464930120725103066140763137828793748",
"257022177564321926839343161281285874317",
"187323892497721098193350031139701317305",
"211858484541018173177232802526980496739",
"127082700476439525079209641184017286260",
"207595500258306630795491177285430388995",
"168454730404892075106994848327984530845",
"218188416243712931651921349981765039546",
"119373215220266814155862783695884915755",
"74052400548209328731711756175786501918",
"119730882731057139552713333680099632794",
"266016201252775468633491569535813497184",
"63000146090874992851417898116936339580",
"113317852001645032477968268686908535838",
"312003032799094112922801301182157311821",
"326354901076355971873288704935948688613",
"19924341711483973471876240021155504678",
"43728446928011602045002302582941866376",
"211209783633356644266377190063189510007",
"26625414007268669380281060674663768502",
"212018372378049822348852397801866290775",
"98155178234896187172567094502305688584",
"229122881178563849373052745601739436785",
"113359577646284054713557054054035753449",
"166402859978215576839697980564133201602",
"217972002802524071126746769538830367945",
"58396819470224084037287297529846936948",
"253591750081865864924061231507480291176",
"187312614709061748114757109887046104322",
"223938328503353462867327098050396137230",
"229569335724303047278722204601823220334",
"225246042900715182497321222159328815726",
"97210065370098158333257353080179614504",
"252104149107802057122394103593504634044",
"317196726504677505527883035845946949050",
"317115750280702552796415020543278407990",
"238780724378965894394446267741184178213",
"72734907594396137672613055680474202288",
"202972081764351327802986511114449630737",
"116503063541181432362663409243189980610",
"37312102513848841531587800322709678347",
"107730220799135238152532029834121092533",
"31794532484850939514757996360684657504",
"37375231683822265134606901847529779397",
"85622638563348469393500256713083172957",
"67370821526098988450755233631823663626",
"240631804555240451842890633454648658600",
"32982486088803618325346264503483052175",
"203581590381330725659643980622370901602",
"26474390563869351973523899735274801275",
"247931793445382452109740253630732743691",
"143473210975978939542436227292163065865",
"110373803346656416955257835554183869064",
"244158909220927486445490508396881294803",
"265147401089949882638393063931419992317",
"21506092549905763193159073738517381720",
"29553713582354736413226004466626485820",
"185873386596273317367644744329031272674",
"245129173415648111384771565775138186764",
"201152589758377086475944314303889722788",
"235733155212897949369853215540913567803"
]
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/media_tools/mpegts.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-24829-f3a4e474",
"digest": {
"length": 1074,
"function_hash": "209161400580859266801915008400375079718"
},
"source": "https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2",
"target": {
"file": "src/odf/odf_code.c",
"function": "gf_odf_read_iod"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:10:37Z"
}
}
],
"modified": "2026-10-20T14:10:37.004476407Z",
"provider": "osv",
"references": [
"https://github.com/gpac/gpac/blob/v0.5.2/src/media_tools/mpegts.c#L2204",
"https://github.com/gpac/gpac/issues/1422",
"https://github.com/gpac/gpac/commit/8c5e847185d74462d674ee7d28fb46c29dae6dd2"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-24829",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388631,
"published_at": "2021-08-04T21:15:08.077+00:00"
}