CVE-2021-30022: Gpac

Medium severity, CVSS 5.5. EPSS: 1.1% chance of exploitation in the next 30 days.

There is a integer overflow in media_tools/av_parsers.c in the gf_avc_read_pps_bs_internal in GPAC from 0.5.2 to 1.0.1. pps_id may be a negative number, so it will not return. However, avc->pps only has 255 unit, so there is an overflow, which results a crash.

Affected products

• Gpac Gpac: from 0.5.2, up to and including 1.0.1

Published 2021-04-19. Last modified 2026-06-17.