CVE-2022-47090
📋 TL;DR
This vulnerability is a buffer overflow in GPAC MP4box's VVC video parser that occurs when processing specially crafted video files. Attackers could exploit this to execute arbitrary code or cause denial of service. Users who process untrusted video files with vulnerable GPAC versions are affected.
💻 Affected Systems
- GPAC MP4box
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise when processing malicious video files
Likely Case
Application crash (denial of service) when processing malformed video content
If Mitigated
Limited impact with proper input validation and sandboxing in place
🎯 Exploit Status
Exploitation requires crafting a malicious VVC video file and convincing a user to process it
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 48760768611f6766bf9e7378bb7cc66cebd6e49d
Vendor Advisory: https://github.com/gpac/gpac/issues/2341
Restart Required: No
Instructions:
1. Update GPAC to latest version from official repository
2. Rebuild from source if using custom builds
3. Replace binary installations with patched version
🔧 Temporary Workarounds
Disable VVC processing
allConfigure GPAC to avoid processing VVC video streams
Not applicable - requires code modification or configuration changes
🧯 If You Can't Patch
- Restrict GPAC usage to trusted video files only
- Run GPAC in sandboxed/containerized environment with limited privileges
🔍 How to Verify
Check if Vulnerable:
Check GPAC version with 'MP4Box -version' and compare to affected versionsCheck Version:
MP4Box -versionVerify Fix Applied:
Verify version is newer than commit 48760768611f6766bf9e7378bb7cc66cebd6e49d📡 Detection & Monitoring
Log Indicators:
- GPAC segmentation faults
- Memory access violation errors in application logs
Network Indicators:
- Unusual video file uploads to media processing services
SIEM Query:
Process:MP4Box AND (EventID:1000 OR ExceptionCode:c0000005)