CVE-2026-79514

CVE-2026-79514 is an out-of-bounds read (CWE-125) in the gf_dm_data_received function in downloader.c of GPAC, the open-source multimedia framework, version v26.07.0. The flaw is triggered when the built-in download manager processes data received from a malicious HTTP server — for example, when a GPAC-based application or command-line tool fetches a crafted URL supplied by an attacker, which requires user interaction per the CVSS vector (UI:R). Successful exploitation causes the application to crash, giving the attacker a denial of service with no confidentiality or integrity impact. Affected users are those running GPAC v26.07.0 or applications embedding the GPAC library to fetch media over HTTP. A public proof-of-concept exists as a GitHub issue report, but EPSS is very low (0.2%, 16th percentile) and the flaw is not in the CISA KEV catalog, so exploitation in the wild is not currently indicated.

What to do: Upgrade GPAC to any build containing fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 (i.e., newer than v26.07.0). Until patched, avoid pointing GPAC-based tools (MP4Box, packagers, players, or applications embedding libgpac) at untrusted or user-supplied HTTP URLs, since the crash requires the application to fetch attacker-controlled content. Check crash logs for faults originating in downloader.c's gf_dm_data_received path as an indicator of attempted triggering.