CVE-2020-23930
About
An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function nhmldump_send_header located in write_nhml.c. It allows an attacker to cause Denial of Service.
Rainforest analyst review
A crafted input file drives gpac into a NULL pointer dereference in its NHML header-writing code, crashing the process. The impact is denial of service only, there's no code execution claimed, and it requires local access plus a user actually feeding the malicious file to the tool.
That combination makes this a low-stakes bug. A media-processing library that crashes on bad input is a robustness problem more than a security one, and the local, interaction-dependent trigger keeps it far from anything an attacker exploits remotely or at scale.
Where it matters is inside automated media pipelines that use gpac, where an attacker-supplied file causing a crash could disrupt availability. So our angle is dependency inventory, knowing where gpac is embedded in processing workflows, while ranking the issue down given it's a local, DoS-only defect.
References
Related CVEs
Frequently asked questions
What is CVE-2020-23930?
An issue was discovered in gpac through 20200801. A NULL pointer dereference exists in the function nhmldump_send_header located in write_nhml.c. It allows an attacker to cause Denial of Service.
How severe is CVE-2020-23930?
CVE-2020-23930 carries a CVSS 3.1 base score of 5.5, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 48 out of 100, in the moderate band.
How is CVE-2020-23930 exploited?
According to the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): attack vector Local, attack complexity Low, privileges required None, user interaction Required. Impact on confidentiality None, integrity None and availability High.
Which products are affected by CVE-2020-23930?
Public advisories list the following as affected: gpac. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2020-23930?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.