Description
An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.
Published: 2026-09-09
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read in the gf_dm_data_received function of GPAC's downloader module. When a crafted HTTP request is processed, the function accesses memory beyond the allocated buffer, causing the application to crash. This can be triggered repeatedly by an attacker to exhaust resources and render the GPAC service unavailable.

Affected Systems

GPAC version 26.07.0 is affected. No other vendor or product variants are listed in the CNA data.

Risk and Exploitability

The CVSS score of 6.5 indicates moderate severity. The EPSS score is less than 1%, showing a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attack vectors are inferred to be network‑based, as the flaw is triggered by sending a specially crafted HTTP request to the GPAC downloader. An attacker would need network access to the machine running GPAC to exploit this vulnerability.

Generated by OpenCVE AI on September 21, 2026 at 07:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the GPAC update that includes commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, the fixed version replacing v26.07.0.
  • Configure inbound filtering to block or rate‑limit malformed HTTP requests that could trigger the out‑of‑bounds read.
  • Continuously monitor GPAC process restarts and unusual memory usage to detect potential DoS attempts.

Generated by OpenCVE AI on September 21, 2026 at 07:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Title GPAC Downloader Out-of-Bounds Read Leading to Denial of Service

Mon, 21 Sep 2026 06:00:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read Causing DoS in GPAC Downloader
Weaknesses CWE-788

Tue, 15 Sep 2026 17:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:gpac:gpac:26.07.0:*:*:*:*:*:*:*

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 10 Sep 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Gpac
Gpac gpac
Vendors & Products Gpac
Gpac gpac

Wed, 09 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
Title Out‑of‑Bounds Read Causing DoS in GPAC Downloader
Weaknesses CWE-788

Wed, 09 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Description An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:U/UI:R'}

Subscriptions

Gpac Gpac
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-09-14T14:43:17.725Z

Reserved: 2026-08-25T00:00:00.000Z

Link: CVE-2026-79514

cve-icon Vulnrichment

Updated: 2026-09-14T14:42:58.507Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-09T21:17:04.273

Modified: 2026-09-15T17:03:02.307

Link: CVE-2026-79514

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T08:00:08Z

Weaknesses