Description
A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtin_probe_duration of the file src/filters/load_text.c of the component TeXML File Handler. Such manipulation of the argument txml_timescale leads to divide by zero. An attack has to be approached locally. The name of the patch is 86a5191f2e750c767253e27ed6cfd6d547afebc2. A patch should be applied to remediate this issue.
Published: 2026-07-06
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

This flaw occurs in the GPAC TeXML File Handler’s txtin_probe_duration function in src/filters/load_text.c, where a manipulated txml_timescale argument causes a divide‑by‑zero error. The resulting crash disables GPAC during TeXML file processing, leading to a service interruption for the local user or application that invoked the handler. The weakness is classified as CWE-369 and reflects improper error handling (CWE-404).

Affected Systems

Only the GPAC build 26.03-DEV-rev342-g80071f700-master is known to be affected; no other vendors or product lines are listed.

Risk and Exploitability

The CVSS score of 4.8 indicates moderate severity, while the EPSS score of less than 1 % signals a low likelihood of exploitation. Because the attack requires local host access, an attacker must have sufficient privilege to supply a. The vulnerability is not listed in CISA’s KEV catalog.

Generated by OpenCVE AI on July 23, 2026 at 15:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the patch referenced by commit 86a5191f2e750c767253e27ed6cfd6d547afebc2 to update GPAC to a fixed build.
  • If GPAC was built from source, rebuild and reinstall it from the updated repository to ensure the fix is applied.
  • Run GPAC with the least privilege necessary and restrict TeXML file input permissions to trusted users to contain any inadvertent local exploitation.

Generated by OpenCVE AI on July 23, 2026 at 15:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 07:30:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtin_probe_duration of the file src/filters/load_text.c of the component TeXML File Handler. Such manipulation of the argument txml_timescale leads to divide by zero. An attack has to be approached locally. The name of the patch is 86a5191f2e750c767253e27ed6cfd6d547afebc2. A patch should be applied to remediate this issue.
Title GPAC TeXML File load_text.c txtin_probe_duration divide by zero
First Time appeared Gpac
Gpac gpac
Weaknesses CWE-369
CWE-404
CPEs cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
Vendors & Products Gpac
Gpac gpac
References
Metrics cvssV2_0

{'score': 1.7, 'vector': 'AV:L/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 3.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T12:52:53.879Z

Reserved: 2026-07-05T19:08:37.569Z

Link: CVE-2026-14801

cve-icon Vulnrichment

Updated: 2026-07-06T12:52:38.679Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-23T15:30:04Z

Weaknesses
  • CWE-369

    Divide By Zero

  • CWE-404

    Improper Resource Shutdown or Release