CVE-2026-79513: GPAC Divide-by-Zero DoS Vulnerability

CVE-2026-79513 Overview

CVE-2026-79513 is a divide-by-zero vulnerability in the gf_dash_get_timeline_duration function located in src/media_tools/dash_client.c of GPAC v26.07.0. GPAC is an open-source multimedia framework used for packaging, streaming, and playback of MPEG-DASH and other adaptive streaming formats. Attackers can trigger the flaw by supplying a crafted Media Presentation Description (MPD) with a malformed SegmentTimeline element. Processing the manipulated MPD forces a floating-point exception (FPE) and terminates the process, producing a Denial of Service (DoS) condition. The upstream project addressed the issue in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

Critical Impact

A remote attacker can crash GPAC-based DASH clients or media pipelines by delivering a single crafted MPD manifest, disrupting streaming services and downstream media workflows.

Affected Products

• GPAC v26.07.0
• Applications and services embedding the GPAC DASH client library
• Media pipelines that parse untrusted DASH MPD manifests using GPAC

Discovery Timeline

• 2026-09-09 - CVE-2026-79513 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79513

Vulnerability Analysis

The vulnerability resides in gf_dash_get_timeline_duration, which computes the number of segments in a DASH period based on values parsed from a SegmentTimeline element in the MPD manifest. The function divides the remaining period duration by an ent->duration value taken directly from attacker-controlled manifest data. When ent->duration is zero, the division triggers a floating-point exception and terminates the process handling the manifest. Because MPD manifests are typically fetched over the network, an attacker who controls or tampers with a manifest URL can remotely crash any client or transcoder that ingests the file.

Root Cause

The root cause is missing input validation on the duration field of SegmentTimeline entries before it is used as a divisor. The original code assumed a non-zero duration and performed arithmetic without a guard, resulting in a divide-by-zero condition classified as a Denial of Service (DoS) via Null/Zero Divisor.

Attack Vector

Exploitation requires user interaction: a victim must open or process a crafted MPD manifest with a GPAC-based tool such as MP4Box, gpac, or an application linking the DASH client library. The attack vector is network-accessible, since MPDs are commonly loaded via HTTP(S), and no authentication or elevated privileges are required.

// Patch from src/media_tools/dash_client.c
// Source: https://github.com/gpac/gpac/commit/2fd5a06ab226767900fd86edb5a1e8bfc1010640
            }
        }
        if (!nb_seg) {
-           nb_seg = (u32) ( (period_duration - start_time) / ent->duration );
+           nb_seg = (u32) ( (period_duration - start_time) / (ent->duration ? ent->duration : 1 ) );
            dur += ((u64)nb_seg) * ent->duration;
        }
        *nb_segments += nb_seg;

The fix introduces a ternary guard that substitutes 1 when ent->duration is zero, preventing the divide-by-zero and preserving downstream arithmetic.

Detection Methods for CVE-2026-79513

Indicators of Compromise

• Unexpected SIGFPE (signal 8) termination of GPAC processes such as MP4Box, gpac, or MP4Client
• Core dumps referencing gf_dash_get_timeline_duration in the stack trace
• Repeated crashes correlated with fetching MPD manifests from external or untrusted URLs
• Ingested MPD files containing <S d="0"/> or SegmentTimeline entries with zero-value d (duration) attributes

Detection Strategies

• Statically scan cached or received MPD manifests for SegmentTimeline entries where the d attribute equals zero.
• Monitor process exit codes and crash reports on media servers, transcoders, and playback endpoints running GPAC.
• Instrument DASH pipelines with fuzzing harnesses that submit malformed SegmentTimeline values as part of pre-deployment testing.

Monitoring Recommendations

• Enable core-dump collection and centralize crash telemetry for any host running GPAC binaries or libraries.
• Log all outbound fetches of MPD manifests, including source URL and requesting process, to enable retrospective investigation.
• Alert on abnormal restart loops of media services that follow MPD ingestion events.

How to Mitigate CVE-2026-79513

Immediate Actions Required

• Inventory all systems, containers, and applications that bundle GPAC v26.07.0 or earlier and prioritize them for patching.
• Rebuild or update GPAC from a source tree that includes commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640.
• Restrict DASH clients to trusted manifest sources until patched builds are deployed.

Patch Information

The issue is fixed in upstream GPAC commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. The patch adds a zero-check to the divisor in gf_dash_get_timeline_duration and introduces additional chunk-size validation in src/utils/downloader.c (GF_CHUNK_MAX_SIZE 0x40000000). Track discussion and reproduction details in GitHub Issue #3862.

Workarounds

• Validate and sanitize incoming MPD manifests, rejecting any SegmentTimeline entry where the d attribute is zero.
• Run GPAC-based parsers inside sandboxed or containerized environments with automatic restart to limit service disruption.
• Proxy DASH manifest downloads through a filtering gateway that enforces schema-level checks on segment durations.

# Build patched GPAC from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 2fd5a06ab226767900fd86edb5a1e8bfc1010640
./configure && make -j$(nproc)
sudo make install

# Verify the installed binary version
MP4Box -version