CVE-2024-6061: gpac — Exploit & Fix

Description

A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability.

Is your site exposed to CVE-2024-6061?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

3.3

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness Type (CWE)

CWE-835 CWE-835

Affected Products

Vendor	Product	Versions
gpac	gpac	All

References

Advisories & Patches

https://github.com/gpac/gpac/commit/20c0f29139a82779b86453ce7f68d0681ec7624c https://github.com/gpac/gpac/commit/20c0f29139a82779b86453ce7f68d0681ec7624c

Exploits

https://github.com/gpac/gpac/issues/2871 https://github.com/user-attachments/files/15801058/poc1.zip https://github.com/gpac/gpac/issues/2871 https://github.com/user-attachments/files/15801058/poc1.zip

Other References

https://vuldb.com/?ctiid.268789 https://vuldb.com/?id.268789 https://vuldb.com/?submit.356308 https://vuldb.com/?ctiid.268789 https://vuldb.com/?id.268789 https://vuldb.com/?submit.356308

Frequently Asked Questions

What is CVE-2024-6061? +

A vulnerability has been found in GPAC 2.5-DEV-rev228-g11067ea92-master and classified as problematic. Affected by this vulnerability is the function isoffin_process of the file src/filters/isoffin_read.c of the component MP4Box. The manipulation leads to infinite loop. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is 20c0f29139a82779b86453ce7f68d0681ec7624c. It is recommended to apply a patch to fix this issue. The identifier VDB-268789 was assigned to this vulnerability. It has a CVSS v3.1 base score of 3.3 (LOW).

How severe is CVE-2024-6061? +

CVE-2024-6061 has a CVSS v3.1 score of 3.3 out of 10, rated LOW. This is a low-severity vulnerability with limited impact.

What products are affected by CVE-2024-6061? +

CVE-2024-6061 affects products from gpac, specifically: gpac. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-6061? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-27497

OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server …

CVE-2025-29776

Azle is a WebAssembly runtime for TypeScript and JavaScript on ICP. Calling `setTimer` in Azle versions `0.27.0`, `0.28.0`, and `0.29.0` …

CVE-2025-32029

ts-asn1-der is a collection of utility classes to encode ASN.1 data following DER rule. Incorrect number DER encoding can lead …

CVE-2024-8088

There is a HIGH severity vulnerability affecting the CPython "zipfile" module affecting "zipfile.Path". Note that the more common API "zipfile.ZipFile" …

CVE-2026-63570

Loop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker …

CVE-2026-113792

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a …

CVE-2024-6061