CVE-2026-79514

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in GPAC v26.07.0 Leads to DoS

Publication date: 2026-09-09

Last updated on: 2026-09-15

Assigner: MITRE

Description

An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-15

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-79514

EUVD

EUVD-2026-75166

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	26.07.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read issue in the gf_dm_data_received function located in downloader.c of GPAC version 26.07.0. It allows attackers to cause a Denial of Service by sending a specially crafted HTTP request.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or unusual behavior in GPAC applications when processing HTTP requests. Check GPAC logs for segmentation faults or out-of-bounds read errors. Network monitoring tools can detect malformed HTTP requests targeting GPAC servers.

Impact Analysis

The vulnerability can lead to a Denial of Service, meaning an attacker could crash the application or system by exploiting this flaw. This may disrupt services relying on GPAC for media processing.

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via crafted HTTP requests, which could disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, such disruptions may impact availability requirements for systems processing personal or health data.

Mitigation Strategies

Upgrade GPAC to version 26.07.0 or later where the vulnerability is fixed. If immediate upgrade is not possible, restrict network access to GPAC services or implement input validation for HTTP requests to prevent crafted payloads.

Hi! I’m here to help you understand CVE-2026-79514. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70