High
Security advisory
Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-31255
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:43 UTC · Revision 1
Source evidence
Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.
osv:CVE-2021-31255
Complete source record
{
"id": "44acb00bdafa56f386f3cf1ec71c469351632827486832f28c74be404da2dc9d",
"url": "https://osv.dev/vulnerability/CVE-2021-31255",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-31255",
"summary": "Buffer overflow in the abst_box_read function in MP4Box in GPAC 1.0.1 allows attackers to cause a denial of service or execute arbitrary code via a crafted file.",
"evidence": "osv:CVE-2021-31255",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-31255",
"aliases": [
"CVE-2021-31255"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/gpac/gpac",
"type": "GIT",
"events": [
{
"introduced": "d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"
},
{
"last_affected": "d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"
},
{
"fixed": "758135e91e623d7dfe7f6aaad7aeb3f791b7a4e5"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:gpac:gpac:1.0.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.0.1"
},
{
"last_affected": "1.0.1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "758135e91e623d7dfe7f6aaad7aeb3f791b7a4e5"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.0.1",
"v1.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31255.json",
"vanir_signatures": [
{
"id": "CVE-2021-31255-0a60e3ae",
"digest": {
"length": 2961,
"function_hash": "258107245646406056128312222982400552579"
},
"source": "https://github.com/gpac/gpac/commit/758135e91e623d7dfe7f6aaad7aeb3f791b7a4e5",
"target": {
"file": "src/isomedia/box_code_adobe.c",
"function": "abst_box_read"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-31255-52f9b7e4",
"digest": {
"threshold": 0.9,
"line_hashes": [
"301382608729446269365151235785974737478",
"75054795995859823563815861102173490197",
"315456445040147107162021986690348805427",
"225363387238460481647379915371535623564",
"71383011012101062220920403852973743502",
"104677662135597084008771331119918235830",
"167561066845525403094025143433092494509",
"186300160836660328309793856079987044352",
"18497645211342342616849183313929535435",
"97517475652552002037337088837171814185",
"99531149942437825256231186111731274008",
"146128374334610018233541624921101709326",
"68743514124483372158713313988834004406",
"293300962827672730868945970121325663209",
"123394942549030022420997627546789938407",
"67237580303590551111106756338047361850",
"201571817422873628975451470563366099396",
"95167646658689461293592437673434324116",
"237344818774656427417038117711684189812",
"115123881686827374563751784127087421641",
"40654507533914248073688996812105205155",
"163486723301630551627883101424811552626",
"124249159815353891918539569287450864642",
"14390606280053364047803312310944680490",
"145159841787894039502457097424864257663",
"116598338347827938589087750683305816621",
"137214260005058337270646991498447434603",
"123394942549030022420997627546789938407",
"67237580303590551111106756338047361850",
"201571817422873628975451470563366099396",
"95167646658689461293592437673434324116",
"237344818774656427417038117711684189812",
"115123881686827374563751784127087421641",
"40654507533914248073688996812105205155",
"163486723301630551627883101424811552626",
"248237885344517459871987645121282351620",
"322956225853754395889529311189350061083",
"209025649325939162191136562801757898137",
"60609379034290175193739317541802162940",
"266324919719795563115772832387976086396",
"270142195143608987813010832335665371355",
"305515094175571391748610138480897457640",
"71383011012101062220920403852973743502",
"104677662135597084008771331119918235830",
"167561066845525403094025143433092494509",
"186300160836660328309793856079987044352",
"18497645211342342616849183313929535435",
"265869590104449316041780791064138757649",
"133283124060172814566465066055946039992",
"295199604222813044186767984753633152098",
"18893248543791392197083881052570092996",
"60609379034290175193739317541802162940",
"266324919719795563115772832387976086396",
"270142195143608987813010832335665371355",
"305515094175571391748610138480897457640",
"71383011012101062220920403852973743502",
"104677662135597084008771331119918235830",
"167561066845525403094025143433092494509",
"186300160836660328309793856079987044352",
"18497645211342342616849183313929535435",
"176718476252993577071858158525178524806",
"215269135801208712367927128104065341101"
]
},
"source": "https://github.com/gpac/gpac/commit/758135e91e623d7dfe7f6aaad7aeb3f791b7a4e5",
"target": {
"file": "src/isomedia/box_code_adobe.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T14:21:52Z"
}
}
],
"modified": "2026-10-20T14:21:52.032103160Z",
"provider": "osv",
"references": [
"https://github.com/gpac/gpac/commit/758135e91e623d7dfe7f6aaad7aeb3f791b7a4e5",
"https://github.com/gpac/gpac/issues/1733"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-31255",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388830,
"published_at": "2021-04-19T19:15:18.14+00:00"
}