CVE-2021-45266: 
NixOS vulnerability analysis and mitigation

A null pointer dereference vulnerability was discovered in gpac version 1.1.0 via the lsr_read_anim_values_ex function. The vulnerability was disclosed on December 22, 2021 and assigned identifier CVE-2021-45266. This security flaw affects the gpac software package, specifically version 1.1.0 (NVD, GitHub Issue).

The vulnerability exists in the lsr_read_anim_values_ex function of gpac 1.1.0. When triggered, it causes a null pointer dereference that results in a segmentation fault and application crash. The issue was discovered during testing with MP4Box, a component of GPAC. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability leads to a segmentation fault and application crash, resulting in a denial of service condition. The vulnerability affects the availability of the system but does not appear to impact confidentiality or integrity (NVD).

The vulnerability can be triggered through the MP4Box utility when processing certain LSR (LASeR) content. A proof of concept demonstrating the crash has been documented, showing that the issue can be reproduced using specific command-line arguments (GitHub Issue).