{"id":"CVE-2021-40574","details":"The binary MP4Box in Gpac from 0.9.0-preview to 1.0.1 has a double-free vulnerability in the gf_text_get_utf8_line function in load_text.c, which allows attackers to cause a denial of service, even code execution and escalation of privileges.","modified":"2026-08-03T14:35:19.561034Z","published":"2022-01-13T19:15:08.317Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.9.0"},{"last_affected":"1.0.1"}],"source":"CPE_RANGE","vendor_product":"gpac:gpac"}]},"references":[{"type":"WEB","url":"https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L232"},{"type":"WEB","url":"https://github.com/gpac/gpac/blob/v0.9.0-preview/src/filters/load_text.c#L304"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5411"},{"type":"REPORT","url":"https://github.com/gpac/gpac/issues/1897"},{"type":"FIX","url":"https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/gpac/gpac","events":[{"introduced":"0"},{"fixed":"30ac5e5236b790accd1f25347eebf2dc8c6c1bcb"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.0.0","v0.9.0","v0.9.0-preview","v0.6.0","v0.5.2"],"database_specific":{"vanir_signatures_modified":"2026-08-03T14:35:19Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"230210492341566583915014837668410286663","length":1611},"id":"CVE-2021-40574-5f2a698c","signature_type":"Function","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb","target":{"file":"src/filters/load_text.c","function":"gf_text_get_utf8_line"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb","target":{"file":"src/filters/load_text.c"},"deprecated":false,"digest":{"line_hashes":["180728915578673776719162757042366151258","240734627911263875664516209368288375490","222287515743341404633450966596245244444","64109077259693350474625864948021857235","166482483231269289728412799493455409256","294305885484496685493816442798177987069","339237291132411872005631746324972709639","158498996080456010138040219121678181146","128200279200830873988320868286409958588","181105664868832716179405220100333977639","164337026075874724797191200993357550532","106130394707070135858149980450533248725"],"threshold":0.9},"id":"CVE-2021-40574-8b3557f3"},{"signature_version":"v1","source":"https://github.com/gpac/gpac/commit/30ac5e5236b790accd1f25347eebf2dc8c6c1bcb","target":{"file":"src/filters/load_text.c","function":"gf_text_process_sub"},"deprecated":false,"digest":{"function_hash":"194929129869498996262184414212790556334","length":3374},"id":"CVE-2021-40574-905b8074","signature_type":"Function"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-40574.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}