CVE-2021-46038: 
NixOS vulnerability analysis and mitigation

A Pointer Dereference vulnerability was discovered in GPAC 1.0.1, specifically in the unlink_chunk.isra function. The vulnerability was assigned CVE-2021-46038 and was disclosed on January 5, 2022. This security flaw affects GPAC multimedia framework version 1.0.1 (NVD, CVE).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 5.5 (Medium). The attack vector is Local (AV:L), with Low attack complexity (AC:L), requiring no privileges (PR:N) but user interaction (UI:R). The scope is Unchanged (S:U), with no impact on confidentiality (C:N) or integrity (I:N), but High impact on availability (A:H) (NVD).

The vulnerability can cause a Denial of Service condition when exploited, affecting the availability of the system. The impact is context-dependent, potentially disrupting normal operations of applications using the GPAC framework (NVD).

The vulnerability has been addressed in subsequent releases. For Debian's stable distribution (bullseye), the fix was implemented in version 1.0.1+dfsg1-4+deb11u2. Users are recommended to upgrade their GPAC packages to the patched version (Debian Advisory).