CVE-2021-40574 – CVE-2021-40574 is a double-free vulnerability i... (How to Fix)

📋 TL;DR

CVE-2021-40574 is a double-free vulnerability in Gpac's MP4Box binary that allows attackers to cause denial of service, execute arbitrary code, or escalate privileges. This affects users processing malicious text-based media files with vulnerable versions of Gpac. The vulnerability resides in the gf_text_get_utf8_line function in load_text.c.

💻 Affected Systems

Products:

Gpac
MP4Box

Versions: 0.9.0-preview through 1.0.1

Operating Systems: Linux, Windows, macOS, BSD

Default Config Vulnerable: ⚠️ Yes

Notes: Any system using MP4Box to process text-based media files (like subtitles) is vulnerable. The vulnerability is triggered when parsing UTF-8 text lines in media files.

📦 What is this software?

Gpac by Gpac

View all CVEs affecting Gpac →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, privilege escalation to root/admin, and persistent backdoor installation.

🟠

Likely Case

Denial of service through application crashes when processing malicious media files, potentially disrupting media processing workflows.

🟢

If Mitigated

Limited to application crashes with proper sandboxing and privilege separation, preventing system-wide impact.

🌐 Internet-Facing: MEDIUM - Requires processing malicious files, but MP4Box is often used in automated media processing pipelines that could ingest untrusted content.

🏢 Internal Only: LOW - Typically requires user interaction or specific workflow to process malicious files, reducing attack surface in controlled environments.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires crafting a malicious media file with specific text content. The double-free vulnerability can be leveraged for memory corruption leading to code execution. Public proof-of-concept exists in GitHub issues.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in commit 30ac5e5236b790accd1f25347eebf2dc8c6c1bcb and later versions

Vendor Advisory: https://github.com/gpac/gpac/security/advisories

Restart Required: Yes

Instructions:

1. Update Gpac to version after commit 30ac5e5236b790accd1f25347eebf2dc8c6c1bcb
2. Rebuild from source or use updated package from distribution repositories
3. Restart any services using MP4Box

🔧 Temporary Workarounds

Disable text processing

all

Avoid processing media files with text tracks or subtitles using MP4Box

mp4box -no-text input.mp4

Sandbox execution

linux

Run MP4Box in a container or sandbox with limited privileges

docker run --rm -v $(pwd):/data gpac mp4box input.mp4

🧯 If You Can't Patch

Implement strict input validation for media files before processing with MP4Box
Run MP4Box with minimal privileges (non-root user, seccomp, AppArmor/SELinux profiles)

🔍 How to Verify

Check if Vulnerable:

Check Gpac version: mp4box -version | grep 'GPAC' and compare to affected range 0.9.0-preview to 1.0.1

Check Version:

mp4box -version 2>&1 | grep -i gpac

Verify Fix Applied:

Verify version is newer than commit 30ac5e5236b790accd1f25347eebf2dc8c6c1bcb or check if binary contains the patched load_text.c

📡 Detection & Monitoring

Log Indicators:

MP4Box segmentation faults
Memory corruption errors in system logs
Unexpected process termination of mp4box

Network Indicators:

Unusual outbound connections from media processing servers
Large volumes of media file uploads to processing systems

SIEM Query:

process_name="mp4box" AND (event_type="crash" OR exit_code="139")

📊 Metadata

CVE ID: CVE-2021-40574

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-415

Published: January 13, 2022

Last Updated: March 7, 2025

🔗 References

https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L232 Product
https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L304 Product
https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb Patch,Third Party Advisory
https://github.com/gpac/gpac/issues/1897 Exploit,Issue Tracking,Third Party Advisory
https://www.debian.org/security/2023/dsa-5411 Mailing List,Third Party Advisory
https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb Patch,Third Party Advisory
https://github.com/gpac/gpac/issues/1897 Exploit,Issue Tracking,Third Party Advisory
https://www.debian.org/security/2023/dsa-5411 Mailing List,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-40574, you might also want to check these: