LiveActive security incident?Get immediate response
CVE Record

CVE-2018-20762: GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in ap...

GPAC version 0.7.1 and earlier has a buffer overflow vulnerability in the cat_multiple_files function in applications/mp4box/fileimport.c when MP4Box is used for a local directory containing crafted filenames.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw affects GPAC MP4Box 0.7.1 and earlier. If MP4Box processes a local directory containing specially crafted filenames, a buffer overflow can occur. Business risk depends on whether media-processing workflows accept files or directories from untrusted users, partners, uploads, or automated ingestion pipelines.

Executive priority

Prioritize remediation where MP4Box processes user-supplied or partner-supplied media directories. For isolated desktop or controlled internal workflows, handle through normal patch management unless additional exposure is found.

Technical view

CVE-2018-20762 is a buffer overflow in GPAC's cat_multiple_files function in applications/mp4box/fileimport.c. The trigger condition described by CVE is MP4Box operating on a local directory with crafted filenames. Public metadata does not provide CVSS, CWE, or detailed impact beyond the overflow condition.

Likely exposure

Most exposure is in servers, build systems, desktop tools, or media pipelines using GPAC/MP4Box to process directories influenced by untrusted content. Systems that do not run MP4Box, or only process tightly controlled local filenames, are less likely to be exposed.

Exploitation context

The source bundle does not show active exploitation, and the CVE is not listed as KEV. The described precondition requires crafted filenames in a local directory processed by MP4Box, so exploitation appears workflow-dependent rather than broadly network-reachable.

Researcher notes

Key evidence is the CVE description, upstream commit, GitHub issue, and Debian/Ubuntu advisories. Source metadata lacks CVSS, CWE, and precise fixed-version details. Treat affected scope as GPAC 0.7.1 and earlier unless vendor advisories identify patched downstream package versions.

Mitigation direction

  • Upgrade GPAC/MP4Box using applicable vendor packages that include the upstream fix.
  • Apply Debian DLA-1693-1 or Ubuntu USN-3926-1 where those distributions are in use.
  • Check upstream GPAC guidance and the referenced fix commit for non-distribution builds.
  • Restrict untrusted users from controlling filenames in directories processed by MP4Box.
  • Run media-processing jobs with least privilege and isolated working directories.

Validation and detection

  • Inventory GPAC and MP4Box installations, including bundled copies in media tools.
  • Confirm installed versions are newer than GPAC 0.7.1 or vendor-patched.
  • Review jobs for MP4Box directory concatenation or import workflows.
  • Verify update records mention CVE-2018-20762 or the referenced upstream fix.
  • Check whether uploads or partner feeds can create filenames in MP4Box input directories.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2018-20762 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.