CVE-2021-46236: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability exists in GPAC v1.1.0 via the function gf_sg_vrml_field_pointer_del() at scenegraph/vrml_tools.c. This vulnerability can lead to a Denial of Service (DoS) (NVD, GitHub Issue).

The vulnerability exists in the gf_sg_vrml_field_pointer_del() function located in scenegraph/vrml_tools.c at line 667. When a NULL pointer is passed to this function, it attempts to dereference it while handling MFDouble field types, leading to a segmentation fault. The vulnerability has a CVSS v3.1 Base Score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) (NVD).

The successful exploitation of this vulnerability results in a Denial of Service (DoS) condition through application crash when processing certain SVG files. This affects the availability of the GPAC application (NVD).

The vulnerability can be triggered by providing a specially crafted SVG file to the MP4Box utility. A proof of concept has been demonstrated using the command './bin/gcc/MP4Box -svg POC2 POC2.zip' which results in a segmentation fault (GitHub Issue).

The vulnerability affects GPAC version 1.1.0. Users should update to a patched version when available. No specific workarounds have been publicly documented (NVD).