Out-of-Bounds Read in GPAC MP4Box via AC4 File

Executive Summary

This vulnerability is an out-of-bounds read in the GPAC project's MP4Box tool. It occurs in the function gf_odf_ac4_cfg_dsi_v1 located in the odf/descriptors.c file. The issue arises when processing AC-4 audio streams with invalid frame rate indices. The code fails to validate the frame_rate_index before accessing fixed-size tables, leading to a segmentation fault due to a read memory access violation.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires analyzing GPAC/MP4Box versions and processing AC-4 audio files. Check installed GPAC version with `MP4Box -version` and compare against v26.07.0. Test with malformed AC-4 files to trigger crashes. Use fuzzing tools like AFL or libFuzzer on descriptors.c to identify out-of-bounds reads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing the application when it processes a maliciously crafted AC-4 audio file. If you use GPAC's MP4Box to handle AC-4 audio streams, an attacker could exploit this flaw to make the software stop responding, potentially disrupting media processing tasks.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via out-of-bounds read in GPAC Project/MP4Box, which may lead to application crashes when processing malformed AC-4 audio files. While not directly impacting GDPR or HIPAA compliance, such crashes could disrupt systems handling sensitive data, potentially affecting availability requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GPAC to v26.07.0 or later. Avoid processing untrusted AC-4 files. Apply the patch from commit 13eb5b7 which includes bounds checking for frame_rate_index. Monitor GPAC releases for additional security fixes.

Useful 0 Not Useful 0