Security readout for executives and security teams
Plain-English summary
CVE-2021-21848 is a high-severity media parsing flaw in GPAC. A crafted MPEG-4 video can trigger memory corruption when opened or decoded by vulnerable GPAC code. The business risk is highest where users or automated workflows process untrusted video files.
Executive priority
Prioritize remediation for systems that process external video content or support user-uploaded media. User interaction is required in the cited CVSS vector, but media parsers are often embedded in automated workflows, which can raise operational exposure.
Technical view
GPAC Advanced Content v1.0.1 and commit a8a8d412 are affected. The MPEG-4 parser reuses stsz parsing logic for stz2 atoms, allowing unchecked arithmetic to cause integer overflow and a heap-based buffer overflow. Sources classify this under CWE-680 with CVSS 8.8.
Likely exposure
Exposure is likely where GPAC or libgpac is installed directly, bundled inside media tools, or used in video ingestion pipelines. Desktop users are exposed if persuaded to open malicious videos. Automated processing of untrusted uploads may also be relevant if it uses vulnerable GPAC components.
Exploitation context
The provided sources describe exploitability through a video opened by a user. The CVE is not listed as KEV in the bundle, and no provided source states active exploitation. Treat public exploit status as unconfirmed from this evidence.
Researcher notes
Key area is MPEG-4 atom parsing, specifically stz2 handling through stsz parser reuse and unchecked arithmetic before allocation/copy behavior. The provided evidence supports memory corruption and high impact, but does not provide active exploitation or exact upstream fixed versions.
Mitigation direction
- Upgrade GPAC/libgpac using Debian DSA-4966 or vendor guidance.
- Check application vendors for bundled GPAC fixes before assuming patched status.
- Avoid opening or processing untrusted MPEG-4 files until updated.
- Isolate or sandbox media decoding workflows that handle user-supplied files.
- Restrict upload pipelines that feed GPAC to trusted sources where feasible.
Validation and detection
- Inventory systems for GPAC, libgpac, and bundled GPAC dependencies.
- Compare installed versions against GPAC v1.0.1 and affected commit evidence.
- Review video-processing services for MPEG-4 decoding with GPAC.
- Confirm Debian-managed systems received DSA-4966 updates where applicable.
- Validate remediation by package version or vendor advisory, not malicious samples.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-680: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-21848 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H2.85.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297CVE reference · x_refsource_MISC
- DSA-4966CVE reference · vendor-advisory, x_refsource_DEBIAN
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.