{"id":"CVE-2023-1655","summary":"Heap-based Buffer Overflow in gpac/gpac","details":"Heap-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.4.0.","modified":"2026-08-12T13:33:48.336231Z","published":"2023-03-27T00:00:00Z","database_specific":{"cna_assigner":"@huntrdev","cwe_ids":["CWE-122"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1655.json"},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/05f1d1de-bbfd-43fe-bdf9-7f73419ce7c9"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1655.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-1655"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"5d70253ac94e5840be7b86054131dd753af63cc7"},{"fixed":"e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4"}],"database_specific":{"cpe":"cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.4.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v2.2.0","v2.0.0","v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4","target":{"file":"src/filters/reframe_rawpcm.c"},"deprecated":false,"digest":{"line_hashes":["318272232109742166985015094536697225242","221236678109456604157263013172807717238","277865214903396827771618897476293937125","272942806729890599600254533063322991960","318844698336108762723034294936321604239","329216109777627982820534922723874699941","215685716164610697747382805803312112132","15469796515733859766920536287694573359","250796319547123837685379131138012802566","102236662579749121613072798131536099584","154125495862581611911616805462536529411","152924356733984361392872817324557440400","218336943783742479602580438281258856636","53391041273617134331202003263371122788","136727173737891208527893124196518843741"],"threshold":0.9},"id":"CVE-2023-1655-3c402887","signature_type":"Line"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["249571260538932152670445539545228447305","152587707489286048113487046699269700399","179615268150946079356232227478217568912","60033637154988124640604107946683507742","282739834311121068751546966263810654625","337334203508275543620516398168354778384","210797623534005381670211559059867641832"]},"id":"CVE-2023-1655-63a629ce","signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/5d70253ac94e5840be7b86054131dd753af63cc7","target":{"file":"src/filters/decrypt_cenc_isma.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4","target":{"function":"pcmreframe_process","file":"src/filters/reframe_rawpcm.c"},"deprecated":false,"digest":{"function_hash":"283741461627766629122018012647522926488","length":4658},"id":"CVE-2023-1655-92c3c5a6"},{"digest":{"function_hash":"203656322894861235209213461815077703107","length":1045},"id":"CVE-2023-1655-9bea63bc","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4","target":{"file":"src/utils/bitstream.c","function":"gf_bs_skip_bytes"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"339597387818010758170673273113920787195","length":3266},"id":"CVE-2023-1655-b25b15ba","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/5d70253ac94e5840be7b86054131dd753af63cc7","target":{"function":"cenc_dec_load_keys","file":"src/filters/decrypt_cenc_isma.c"}},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/e7f96c2d3774e4ea25f952bcdf55af1dd6e919f4","target":{"file":"src/utils/bitstream.c"},"deprecated":false,"digest":{"line_hashes":["217153464431369810088353550240477253197","193765350692698329100038856559947001140","171913979689956171696219296860951797364","290341704576820777074843110085625187866"],"threshold":0.9},"id":"CVE-2023-1655-be549792","signature_type":"Line"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1655.json","vanir_signatures_modified":"2026-08-12T13:33:48Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}