CVE-2026-79522

GPAC v26.07.0, an open-source multimedia framework, contains an out-of-bounds read (CWE-125) in the gf_dm_get_chunk_data function in src/utils/downloader.c. The flaw is triggered when GPAC's HTTP downloader processes a crafted HTTP request/response, for example when a user opens or streams a remote media URL under an attacker's control, causing the application to crash. The impact is limited to denial of service — there is no indication of information disclosure, code execution, or integrity impact (CVSS 3.1: 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Users and automated pipelines running GPAC 26.07.0 that fetch content over HTTP are affected; the issue is fixed in upstream commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. A public proof of concept exists via a GitHub issue tracker entry, but EPSS is very low (0.2%, 16th percentile), the CVE is not in CISA's KEV, and no exploitation in the wild is known.

What to do: Upgrade GPAC to any build containing fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 (post-26.07.0) or apply the patch to downstream packages. Until patched, avoid opening or streaming remote/untrusted HTTP URLs in GPAC and restrict automated pipelines from fetching media from untrusted sources. The flaw is denial-of-service only, so prioritize it below confidentiality/integrity issues, but monitor crashes in downloader code as an indicator of attempted triggering.