CVE-2026-79522

Analyzed Analyzed - Analysis Complete

Out-of-Bounds Read in GPAC v26.07.0

Publication date: 2026-09-09

Last updated on: 2026-09-15

Assigner: MITRE

Description

An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-15

Generated

2026-09-30

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-29

NVD

CVE-2026-79522

EUVD

EUVD-2026-75165

Affected Vendors & Products

Vendor	Product	Version / Range
gpac	gpac	26.07.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is an out-of-bounds read in the gf_dm_get_chunk_data function of GPAC v26.07.0. It allows attackers to cause a Denial of Service by sending a specially crafted HTTP request.

Detection Guidance

Detecting this vulnerability requires monitoring for crashes or unusual behavior in GPAC applications processing HTTP requests. Check for segmentation faults or application hangs when handling network traffic. Inspect logs for errors related to downloader.c or gf_dm_get_chunk_data. No specific commands are provided in the context.

Impact Analysis

The vulnerability can cause a Denial of Service, meaning it may crash or freeze the affected system. This disrupts normal operations and could lead to downtime for services relying on GPAC.

Compliance Impact

This vulnerability causes a Denial of Service (DoS) via crafted HTTP requests, which could disrupt services handling sensitive data. While not directly violating GDPR or HIPAA, such disruptions may impact availability of systems storing personal or health data, potentially leading to compliance issues if service continuity is compromised.

Mitigation Strategies

Update GPAC to version 26.07.0 or later where the vulnerability is fixed. Avoid processing untrusted HTTP requests until patched.

Hi! I’m here to help you understand CVE-2026-79522. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70