CVE-2024-24265: 
NixOS vulnerability analysis and mitigation

A memory leak vulnerability was identified in gpac version 2.2.1, specifically in the gf_filter_pid_merge_properties_internal function through the dst_props variable. The vulnerability was disclosed on February 5, 2024, and has been assigned CVE-2024-24265 (NVD, MITRE).

The vulnerability occurs in the gf_filter_pid_merge_properties_internal function where a pointer variable named dst_props is allocated memory through the check_new_pid_props function but is not properly released. The memory allocation process involves multiple function calls, including gf_props_new and GF_SAFEALLOC, ultimately using the malloc function. The issue manifests when the program returns at line 6131 without freeing the allocated memory, resulting in a memory leak. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability primarily affects system availability through memory resource exhaustion. When exploited, the memory leak can lead to gradual degradation of system performance and potential resource depletion (NVD).

Currently, there are no official patches or workarounds published for this vulnerability. The issue affects gpac version 2.2.1, and users are advised to monitor for updates from the vendor (GitHub Analysis).