CVE-2021-40942: 
NixOS vulnerability analysis and mitigation

In GPAC MP4Box v1.1.0, there is a heap-buffer-overflow vulnerability in the function filter_parse_dyn_args located in filter_core/filter.c:1454. This vulnerability was discovered and reported in September 2021 (GitHub Issue).

The vulnerability occurs when processing files with extremely long path names (length > 1024 characters). The heap buffer overflow is triggered in the filter_parse_dyn_args function, specifically at line 1454 of filter_core/filter.c. According to the CVSS 3.1 scoring, this vulnerability has a base score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) (NVD).

When exploited, this vulnerability can cause a denial of service (DOS) condition through a system crash. The vulnerability affects the availability of the system while not impacting confidentiality or integrity (NVD).

The vulnerability requires local access and user interaction to be exploited. It can be triggered by creating directories with large names (length=255) that make the file's absolute path length larger than 1024 characters, and then using the MP4Box -add command with these paths (GitHub Issue).

The vulnerability affects GPAC MP4Box version 1.1.0. Users should update to a patched version of the software when available. In the meantime, users should avoid processing files with extremely long path names (NVD).