CVE-2026-79522: GPAC Downloader DoS Vulnerability

CVE-2026-79522 Overview

CVE-2026-79522 is an out-of-bounds read vulnerability in the gf_dm_get_chunk_data function located in src/utils/downloader.c of GPAC v26.07.0. Attackers can trigger the flaw by sending a crafted HTTP request, causing a Denial of Service (DoS) condition in the affected multimedia framework. The vulnerability requires user interaction and is exploitable over the network. The GPAC project addressed the issue in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, which introduces chunk size boundary checks to prevent unsafe reads during HTTP chunked transfer processing.

Critical Impact
Successful exploitation results in application crashes and service disruption for any workflow using GPAC to download or process remote media streams.

Affected Products

GPAC v26.07.0
GPAC builds using the vulnerable downloader.c HTTP chunked transfer parsing logic
Applications and pipelines embedding GPAC's downloader module

Discovery Timeline

2026-09-09 - CVE-2026-79522 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-79522

Vulnerability Analysis

The defect resides in gf_dm_get_chunk_data, a helper that parses HTTP chunked transfer-encoding data inside GPAC's download session logic. When a malformed HTTP response advertises a chunk size that exceeds the actual buffer, the function reads past the allocated memory region. This out-of-bounds read [CWE-125] destabilizes the process and terminates the application. The vulnerability affects any consumer of the downloader module, including DASH client workflows in src/media_tools/dash_client.c where an unrelated divide-by-zero was also hardened in the same commit.

Root Cause

The root cause is missing validation of chunk size values returned during HTTP chunked decoding. The pre-patch code trusted the parsed chunk length without bounding it against a maximum expected size. Attacker-controlled HTTP responses could therefore direct the parser to dereference memory outside the download buffer. The patch introduces GF_CHUNK_MAX_SIZE 0x40000000 (1GB) as an upper bound, enabling the downloader to reject or safely handle oversized chunk length declarations.

Attack Vector

An attacker must convince GPAC to fetch content from an attacker-controlled or attacker-influenced HTTP endpoint. The endpoint replies with a malformed chunked response containing an oversized or corrupted chunk length field. When GPAC processes the response, gf_dm_get_chunk_data reads outside the allocated buffer, causing a crash. Exploitation requires user interaction, typically opening a manifest or media URL supplied by the attacker.

// Patch: src/utils/downloader.c - bounded chunk size check
static void gf_dm_connect(GF_DownloadSession *sess);

#define GF_CHUNK_MAX_SIZE 0x40000000 // 1GB

void dm_sess_sk_del(GF_DownloadSession *sess)
{
#ifdef GPAC_HAS_CURL
// Source: https://github.com/gpac/gpac/commit/2fd5a06ab226767900fd86edb5a1e8bfc1010640

// Patch: src/media_tools/dash_client.c - divide-by-zero guard
if (!nb_seg) {
    nb_seg = (u32) ( (period_duration - start_time) / (ent->duration ? ent->duration : 1 ) );
    dur += ((u64)nb_seg) * ent->duration;
}
*nb_segments += nb_seg;
// Source: https://github.com/gpac/gpac/commit/2fd5a06ab226767900fd86edb5a1e8bfc1010640

Detection Methods for CVE-2026-79522

Indicators of Compromise

Unexpected termination or segmentation faults of MP4Box, MP4Client, or gpac processes during HTTP or DASH content retrieval.
HTTP responses to GPAC clients containing chunk-length headers larger than 1GB or malformed hexadecimal chunk size fields.
Repeated download session errors originating from gf_dm_get_chunk_data in application logs.

Detection Strategies

Monitor application crash telemetry for GPAC-derived binaries and correlate with recent outbound HTTP requests.
Inspect HTTP proxy logs for chunked transfer responses with anomalous size declarations targeting media processing hosts.
Match executing GPAC versions against v26.07.0 and flag hosts running builds prior to commit 2fd5a06.

Monitoring Recommendations

Enable core dump collection on servers running GPAC-based transcoding or streaming jobs to capture crash forensics.
Alert on high-frequency GPAC process restarts, which may indicate active DoS attempts against the downloader.
Log outbound URLs consumed by media pipelines and review new or untrusted domains supplying HTTP-chunked media.

How to Mitigate CVE-2026-79522

Immediate Actions Required

Update GPAC to a build that includes commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 or later.
Restrict GPAC to fetching media only from trusted, authenticated origins until patches are applied.
Isolate GPAC transcoding workloads so that a crash cannot cascade into upstream orchestration services.

Patch Information

The fix is available in the GPAC repository via commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. The patch adds a GF_CHUNK_MAX_SIZE (1GB) bound to src/utils/downloader.c and hardens src/media_tools/dash_client.c against a related divide-by-zero. Details are available in the GPAC commit and the associated issue discussion.

Workarounds

Block GPAC clients from accessing untrusted HTTP endpoints via network egress filtering.
Wrap GPAC invocations with a supervisor that auto-restarts crashed processes and rate-limits retries to reduce service disruption.
Disable HTTP chunked transfer usage in upstream reverse proxies where feasible, forcing content-length responses to GPAC consumers.

bash

# Build the patched GPAC from source
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout 2fd5a06ab226767900fd86edb5a1e8bfc1010640
./configure && make -j$(nproc)
sudo make install
gpac -version