PT-2024-22389 · Gpac+2 · Gpac+2

Janette88 · Published 2024-03-15 · Updated 2025-09-26 · CVE-2024-28319

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions gpac version 2.3-DEV-rev921-g422b78ecf-master

Description The issue is related to an out of boundary read vulnerability via the gf dash setup period() function in the media tools/dash client.c file at line 6374. This vulnerability can allow a remote attacker to access confidential information.

Recommendations As a temporary workaround, consider disabling the gf dash setup period() function until a patch is available. Restrict access to the media tools/dash client.c module to minimize the risk of exploitation. Avoid using the gf dash setup period() function in the affected gpac version until the issue is resolved.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-28319

Affected Products

Debian

Red Os

Gpac

References · 14

• 🔥 https://github.com/gpac/gpac/issues/2763 · Exploit
• https://ubuntu.com/security/CVE-2024-28319 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28319 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-28319 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-28319 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-28319 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28319 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-28319 · Security Note
• https://github.com/gpac/gpac/commit/cb3c29809bddfa32686e3deb231a76af67b68e1e · Note
• https://twitter.com/VulmonFeeds/status/1768678844800598184 · Twitter Post
• https://twitter.com/CVEnew/status/1768657211973062723 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-gpac-cve-2024-28318-cve-2024-28319 · Note
• https://t.me/cvenotify/73948 · Telegram Post
• https://t.me/cveNotify/136636 · Telegram Post