CVE-2026-79513

Analyzed Analyzed - Analysis Complete

Divide-by-Zero DoS in GPAC via MPD SegmentTimeline

Publication date: 2026-09-09

Last updated on: 2026-09-15

Assigner: MITRE

Description

A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-15

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-79513

EUVD

EUVD-2026-75167

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	26.07.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-369	The product divides a value by zero.

Attack-Flow Graph

Executive Summary

This is a divide-by-zero vulnerability in the gf_dash_get_timeline_duration function of GPAC v26.07.0. It allows attackers to cause a Denial of Service by exploiting a crafted MPD SegmentTimeline, leading to a crash or system freeze.

Detection Guidance

This vulnerability can be detected by analyzing GPAC logs for crashes or errors related to the gf_dash_get_timeline_duration function when processing MPD SegmentTimeline files. Monitor for divide-by-zero errors or segmentation faults in the media_tools/dash_client.c component.

Impact Analysis

The vulnerability can cause system crashes or unresponsiveness when processing malicious media files, disrupting normal operations. It requires user interaction to trigger via a specially crafted file.

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via a crafted MPD SegmentTimeline, which could disrupt system availability. While it does not directly impact data confidentiality or integrity, prolonged DoS conditions may affect compliance with GDPR (availability principle) or HIPAA (access to systems). However, no specific compliance impact is detailed in the provided context.

Mitigation Strategies

Update GPAC to version 26.07.0 or later to address the divide-by-zero vulnerability in the gf_dash_get_timeline_duration function.

Hi! I’m here to help you understand CVE-2026-79513. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70