CVE-2026-79514: GPAC Media Framework DoS Vulnerability

CVE-2026-79514 Overview

CVE-2026-79514 is an out-of-bounds read vulnerability in the gf_dm_data_received function located in downloader.c of GPAC v26.07.0. GPAC is an open-source multimedia framework used for packaging, streaming, and processing media content. Attackers can trigger the flaw by sending a crafted HTTP request, causing a Denial of Service (DoS) condition in the affected process. The issue was addressed upstream in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, which introduces chunk size validation in the downloader path.

Critical Impact

Remote attackers can cause a Denial of Service by forcing GPAC to read beyond allocated buffer bounds while processing HTTP chunked responses, disrupting media processing workflows that rely on the downloader component.

Affected Products

• GPAC v26.07.0
• GPAC builds incorporating the vulnerable downloader.c prior to commit 2fd5a06
• Applications embedding the GPAC downloader library for HTTP media retrieval

Discovery Timeline

• 2026-09-09 - CVE-2026-79514 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79514

Vulnerability Analysis

The flaw resides in gf_dm_data_received, the callback GPAC uses to process incoming HTTP response data inside src/utils/downloader.c. When the function handles HTTP chunked transfer encoding, it parses chunk size values from the wire without enforcing an upper bound. An attacker-controlled chunk size can cause the parser to read past the allocated buffer during subsequent data handling. The result is an out-of-bounds read that terminates the process, producing a Denial of Service. User interaction is required, typically in the form of loading attacker-controlled media or a malicious streaming URL.

Root Cause

The root cause is missing bounds validation on chunk size values parsed from HTTP responses. The patch introduces a GF_CHUNK_MAX_SIZE constant of 0x40000000 (1 GB) that caps acceptable chunk sizes. A related fix in src/media_tools/dash_client.c addresses a divide-by-zero in DASH segment duration calculation by guarding against a zero ent->duration value.

Attack Vector

Exploitation occurs over the network. An attacker hosts a malicious HTTP endpoint or manipulates a legitimate stream to return a crafted chunked response with abnormal chunk size fields. When a GPAC-based client fetches the resource, gf_dm_data_received reads outside the allocated buffer, crashing the process. No authentication is required, but the victim must initiate the download.

// Patch excerpt: src/utils/downloader.c
static void gf_dm_connect(GF_DownloadSession *sess);

#define GF_CHUNK_MAX_SIZE 0x40000000 // 1GB

void dm_sess_sk_del(GF_DownloadSession *sess)
{
#ifdef GPAC_HAS_CURL

Source: GitHub Commit 2fd5a06

// Patch excerpt: src/media_tools/dash_client.c (related FPE fix)
if (!nb_seg) {
    nb_seg = (u32) ( (period_duration - start_time) / (ent->duration ? ent->duration : 1 ) );
    dur += ((u64)nb_seg) * ent->duration;
}
*nb_segments += nb_seg;

Source: GitHub Commit 2fd5a06

Detection Methods for CVE-2026-79514

Indicators of Compromise

• Unexpected crashes or segmentation faults in MP4Box, gpac, or applications linking libgpac during HTTP media retrieval.
• Core dumps referencing gf_dm_data_received or the downloader session structure in the stack trace.
• HTTP responses to GPAC clients containing chunk size headers exceeding 1 GB or malformed hex encoding.

Detection Strategies

• Inventory hosts running GPAC and compare installed versions against commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640.
• Inspect crash telemetry from media processing services for signatures matching the downloader call path.
• Deploy network intrusion detection signatures that flag HTTP chunked responses with oversized chunk-size fields.

Monitoring Recommendations

• Monitor process supervision logs for repeated restart events on GPAC-based transcoding or streaming workers.
• Correlate outbound HTTP fetch destinations with known-good media origins to surface anomalous domains.
• Track application logs for parser errors emitted by the GPAC downloader when handling chunked transfers.

How to Mitigate CVE-2026-79514

Immediate Actions Required

• Rebuild GPAC from source at commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 or later and redeploy affected binaries.
• Restrict GPAC-based clients to fetching media only from trusted, authenticated origins.
• Isolate media processing workloads so a crash does not disrupt adjacent services.

Patch Information

The fix is available in the upstream GPAC repository via commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. See the GitHub Commit Log and the associated GitHub Issue Discussion for background and validation steps.

Workarounds

• Disable HTTP chunked transfer handling in GPAC-driven workflows where feasible by preferring HTTPS origins with fixed content-length responses.
• Front GPAC downloaders with a reverse proxy that validates and normalizes chunked responses before delivery.
• Run GPAC inside a sandbox or container with automatic restart and rate limits to contain DoS impact.

# Build the patched GPAC from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 2fd5a06ab226767900fd86edb5a1e8bfc1010640
./configure && make -j$(nproc)
sudo make install