CVE-2026-79513

GPAC v26.07.0 contains a divide-by-zero flaw (CWE-369) in the gf_dash_get_timeline_duration function in src/media_tools/dash_client.c, which processes MPEG-DASH MPD manifests. An attacker can craft a malicious MPD with a malformed SegmentTimeline that drives a division by zero when a victim opens or streams it, crashing the application and causing a denial of service. The vulnerability is network-reachable but requires user interaction (the victim must be tricked into loading the crafted manifest), needs no privileges, and impacts availability only — no confidentiality or integrity impact, and no code execution. Anyone running GPAC v26.07.0, including developers, researchers, and applications embedding libgpac for DASH playback or conformance testing, is affected. A public proof-of-concept exists on the GPAC GitHub issue tracker, but EPSS is very low (0.2%, 11th percentile), the flaw is not in the CISA KEV catalog, and no exploitation in the wild is known.

What to do: Upgrade to any GPAC build containing fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 (i.e., newer than v26.07.0) as soon as a patched release is available. In the interim, avoid opening MPD manifests or DASH streams from untrusted sources, and treat unsolicited MPD files as untrusted input. If you embed libgpac in a product, verify which version you ship and add crash-on-malformed-manifest handling (e.g., sandboxing or input validation) since the flaw only causes denial of service, not code execution.