{"id":"CVE-2021-31260","details":"The MergeTrack function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.","modified":"2026-08-07T16:50:22.246275Z","published":"2021-04-19T19:15:18.437Z","references":[{"type":"FIX","url":"https://github.com/gpac/gpac/commit/df8fffd839fe5ae9acd82d26fd48280a397411d9"},{"type":"EVIDENCE","url":"https://github.com/gpac/gpac/issues/1736"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"},{"last_affected":"d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"},{"fixed":"df8fffd839fe5ae9acd82d26fd48280a397411d9"}],"database_specific":{"cpe":"cpe:2.3:a:gpac:gpac:1.0.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.1"},{"last_affected":"1.0.1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.0.1","v1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-31260.json","vanir_signatures_modified":"2026-08-07T16:50:22Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/df8fffd839fe5ae9acd82d26fd48280a397411d9","target":{"file":"src/isomedia/track.c","function":"MergeTrack"},"deprecated":false,"digest":{"function_hash":"335491776138243062977214169613928195094","length":22043},"id":"CVE-2021-31260-8e0aaebf","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/df8fffd839fe5ae9acd82d26fd48280a397411d9","target":{"file":"src/isomedia/track.c"},"deprecated":false,"digest":{"line_hashes":["332524135913515548166291284936394020187","66684748315246422794487471379988225715","234592134305524906353216475174714363829","334297824493727778064126337640881454041","16557750565410202671477080845639013702","273942870660085098662702133124770611172","207848608037353933314262012198414753929","26276709931456932890240036060274974909","144833264415557562291566183312048777532","85215393866482497898822514383938464333","273162639093632930735207659276392843815"],"threshold":0.9},"id":"CVE-2021-31260-f75fbcb0"}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}