{"id":"CVE-2021-32138","details":"The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a denial of service (NULL pointer dereference) via a crafted file in the MP4Box command.","modified":"2026-08-07T16:50:21.495196Z","published":"2021-09-13T20:15:08.343Z","references":[{"type":"FIX","url":"https://github.com/gpac/gpac/commit/289ffce3e0d224d314f5f92a744d5fe35999f20b"},{"type":"FIX","url":"https://github.com/gpac/gpac/issues/1767"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"},{"last_affected":"d8538e8ae946b32d99c6b2c57cbb327146e9cd9d"},{"fixed":"289ffce3e0d224d314f5f92a744d5fe35999f20b"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:gpac:gpac:1.0.1:*:*:*:*:*:*:*","extracted_events":[{"introduced":"1.0.1"},{"last_affected":"1.0.1"}]}}],"versions":["1.0.1","v1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32138.json","vanir_signatures_modified":"2026-08-07T16:50:21Z","vanir_signatures":[{"target":{"file":"applications/mp4box/filedump.c","function":"DumpTrackInfo"},"deprecated":false,"digest":{"function_hash":"72363230087630030596849941900056507927","length":38898},"id":"CVE-2021-32138-94a412c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/289ffce3e0d224d314f5f92a744d5fe35999f20b"},{"digest":{"line_hashes":["110813952207577778474837899797014853756","270844214476017854922214101552119900190","32932475279528246651705038658921617969","18628512939991662238803177973967637439","328807136156796949526559614132055125801","236923671778649612870430103083481700222","66169494858679149215744103948453711159","155596384022551624924261727561163721496","129210666194467045923794921218605162475","180737934796336991252198006935756900992","36846995504410589264330910748381873411","134330799294180370222445525696240321460","290997714870136359489958931391395770606","36228315985012163088552575223570732090","319297280601915710553291807514515423535","60127297917787444437727825201856101588","310868404963924679027873888371384724637","215385272412777472972761329764328174975"],"threshold":0.9},"id":"CVE-2021-32138-eb9f6620","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/289ffce3e0d224d314f5f92a744d5fe35999f20b","target":{"file":"applications/mp4box/filedump.c"},"deprecated":false}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}