CVE-2024-50664

CVE-2024-50664 is a heap buffer overflow vulnerability in GPAC version 2.4, an open-source multimedia framework. The flaw is located at isomedia/sample_descs.c:1799 in the function gf_isom_new_mpha_description within the gpac/MP4Box component. It is associated with CWE-787 (Out-of-bounds Write) and CWE-120 (Buffer Copy without Checking Size of Input).

The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). A local attacker with no privileges can exploit it by tricking a user into processing a malicious file with MP4Box, requiring user interaction. Successful exploitation enables high-impact consequences, including unauthorized access to sensitive data, modification of system integrity, and denial of service through potential arbitrary code execution.

Mitigation details and patches are discussed in the GitHub issue at https://github.com/gpac/gpac/issues/2988. Security practitioners should monitor this repository for updates and apply fixes promptly when available.