CVE-2020-19481: 
NixOS vulnerability analysis and mitigation

An issue was discovered in GPAC before 0.8.0, specifically affecting the MP4Box component. The vulnerability involves an invalid memory read in the gf_m2ts_process_pmt function located in media_tools/mpegts.c that can cause a denial of service when processing a crafted MP4 file (NVD).

The vulnerability is classified as an Out-of-bounds Read (CWE-125) with a CVSS v3.1 Base Score of 5.5 (Medium). The attack vector is Local (AV:L), with Low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R), with an Unchanged scope (S:U) and impact limited to High availability (A:H) (NVD).

When exploited, this vulnerability can lead to a denial of service condition through an invalid memory read operation. The impact is primarily on the availability of the system processing MP4 files using the affected GPAC software (NVD).

The vulnerability requires local access and user interaction to exploit. Multiple proof-of-concept exploits have been documented, including issues with left shift operations of negative values, buffer overflows, and null pointer dereferences in the affected component (GitHub Issue 1265, GitHub Issue 1266, GitHub Issue 1267).

The vulnerability has been patched in GPAC version 0.8.0. Users should upgrade to this version or later to mitigate the risk. A patch has been provided to address the issue (GPAC Patch).