Threat Intelligence Report — CVE-2026-79513

Executive Summary

CVE-2026-79513 is a divide-by-zero (CWE-369) vulnerability in the gf_dash_get_timeline_duration function of src/media_tools/dash_client.c in GPAC v26.07.0. An attacker who can supply a crafted MPEG-DASH MPD SegmentTimeline causes a Denial of Service through a crash in the affected media processing component. The NVD description references a fix commit; however, no patch evidence is available from tracked sources, and no public proof-of-concept, exploit code, or KEV listing currently exists.

Technical Analysis

GPAC (formerly GPAC Media Player) is a widely deployed open-source multimedia framework used for MP4/ISO-BMFF tooling, streaming (DASH/HLS), and media packaging. This vulnerability resides in the DASH client logic (dash_client.c), which parses MPD (Media Presentation Description) manifests — XML documents that declare segment timing relationships used by a DASH player/dash-client.

The affected function, gf_dash_get_timeline_duration, computes the duration of a SegmentTimeline element. A SegmentTimeline (<S> entries) describes segment durations via attributes such as t (start time), d (duration), and r (repeat count). The function is therefore a duration arithmetic routine operating on attacker-controlled XML numeric fields.

A divide-by-zero occurs when a divisor derived from parsed manifest values evaluates to zero. The specific divisor fields are not enumerated in the NVD description and cannot be stated with certainty; no code quote was provided. The vulnerability class is unambiguous, though: an unvalidated zero denominator in the duration calculation. On affected platforms this typically results in a fatal signal (SIGFPE on integer division) or a floating-point exception / undefined behavior — crashing the process consuming the manifest.

Attack surface and access vector:

• Network vector (AV:N) — the malicious MPD is an XML document typically retrieved over HTTP(S) or transferred as a file.
• Low complexity (AC:L) — the flaw is reachable by parsing a crafted SegmentTimeline; no race or complex state is required.
• No privileges (PR:N), but user interaction is required (UI:R) — the description frames this as a crafted-manifest DoS, consistent with the victim needing to open, load, or stream the manifest in a GPAC-based tool.

Because the affected component is a general-purpose library (not a server daemon by itself), the practical exposure depends entirely on how dash_client.c is embedded: CLI media tooling (e.g., MP4Box-style invocation against a remote MPD), automated transcoding/packaging pipelines resolving a remote manifest, or any service that ingests untrusted DASH manifests. The impact is strictly availability (C:N/I:N/A:H) — no confidentiality or integrity impact is claimable from the description.

Exploitation Scenarios

No public PoC exists for CVE-2026-79513; the attack chain below is inferred at the vulnerability-class level (CWE-369, divide-by-zero in manifest timing arithmetic). No function names, endpoints, or parameters beyond those in the NVD description are asserted.

1. Reconnaissance / target identification. The attacker identifies an environment that processes untrusted MPD manifests with GPAC v26.07.0 — for example, a media ingest or transcoding service, or a user running GPAC tooling against a third-party manifest. The target is recognizable from the presence of GPAC tooling and an input path that accepts MPD/XML from the network or from an attacker-influenced source.

2. Triggering the flaw class. The attacker crafts an MPD containing a SegmentTimeline whose parsed timing values drive gf_dash_get_timeline_duration into a division where the denominator resolves to zero. Because the flaw is a divide-by-zero, the malicious manifest does not need to exploit memory corruption or execute code — only to reach the arithmetic with a zero divisor. Per the NVD description, this is the sole described trigger; the exact attribute combination is not enumerated and is therefore not asserted here.

3. Delivery / execution. Delivery is via the manifest itself: a remote MPD URL the victim loads, or a manifest file supplied to the victim (consistent with UI:R). When the affected code path parses the crafted SegmentTimeline, the zero-divisor condition is hit and the consuming process terminates abnormally (crash). No code execution, payload staging, or exploitation primitive beyond the crash is described.

4. Post-exploitation impact. The result is a denial of service against the process/function that loaded the manifest. In a pipeline context, a single crafted manifest can halt a processing job; if an automated service repeatedly resolves attacker-supplied manifests, the crash can be triggered repeatedly (availability degradation). There is no described path to data theft, tampering, or lateral movement.

Impact Assessment

• Availability (High, A:H): The core impact is process termination via divide-by-zero. For any consumer of untrusted MPDs, this is a straightforward crash condition.
• Confidentiality / Integrity (None): The CVSS vector assigns no C or I impact; nothing in the description supports data exposure or modification.
• Blast radius: Bounded to the process handling the manifest. The risk escalates where GPAC is embedded in shared services or batch pipelines: one malformed manifest can abort jobs, and repeated submissions can sustain an outage.
• Exploitability: AV:N/AC:L/PR:N with UI:R and base score 6.5 reflects a low-effort, remotely deliverable DoS that still requires the victim to load the manifest. No KEV listing, no EPSS score (not yet scored by FIRST.org), and no public exploit reduce the immediate real-world urgency relative to actively exploited CVEs — but availability-focused flaws in media pipelines are frequently abused for resource-exhaustion and disruption.
• Uncertainty: Given patch confidence 0/4 and no affected-version list, the precise population of vulnerable deployments is not confirmed; v26.07.0 is the version explicitly named in the description.

Detection Guidance

Detection must focus on (a) availability of the media process/host as a crash signal and (b) anomalous MPD SegmentTimeline content in transit or in logs. Because no specific attribute values are published, signatures are built around the crash class (SIGFPE) and around manifest parsing activity, not around a known payload.

Sigma Rule

title: GPAC Divide-by-Zero DoS via Crafted DASH SegmentTimeline (CVE-2026-79513)
id: 5a9c1e2f-7b3d-4c8a-9f21-gpac79513
status: experimental
description: Detects abnormal termination of GPAC-based processes consistent with a divide-by-zero (SIGFPE) while parsing a crafted DASH MPD SegmentTimeline.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79513
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_sigfpe:
    type: 'EXEC'
    exe|endswith:
      - '/MP4Box'
      - '/gpac'
      - '/gpac-dash'
  selection_signal:
    a0: 'SIGFPE'
  selection_exit:
    exit|gte: 128
    exit|lte: 159
  condition: selection_sigfpe or (selection_signal and selection_exit)
falsepositives:
  - Unrelated arithmetic faults in other media tooling
  - Legitimate non-zero exit codes from GPAC CLI usage
level: medium
tags:
  - attack.t1499
  - cve.2026.79513

YARA Rule

rule MPD_Crafted_SegmentTimeline_GPAC_CVE_2026_79513
{
    meta:
        description = "Detects DASH MPD manifests containing SegmentTimeline structures that may trigger divide-by-zero in GPAC gf_dash_get_timeline_duration"
        cve = "CVE-2026-79513"
        author = "valtersit.com Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79513"

    strings:
        $mpd        = "<MPD" ascii wide nocase
        $timeline   = "<SegmentTimeline" ascii wide nocase
        $sdur_zero  = /<S[^>]*\bd\s*=\s*"0"/ ascii wide nocase
        $srep_zero  = /<S[^>]*\br\s*=\s*"0"/ ascii wide nocase

    condition:
        $mpd and $timeline and ($sdur_zero or $srep_zero)
}

Note: YARA cannot detect a runtime division; this rule flags MPD manifests exhibiting zero-valued timing attributes (d="0" or r="0") within a SegmentTimeline, which is the plausible class of crafted input. Validate against known-good manifests before production use.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79513 GPAC DASH SegmentTimeline divide-by-zero manifest attempt"; flow:established,to_client; http.response_body; content:"<SegmentTimeline"; nocase; content:"<S"; nocase; pcre:"/<S[^>]*\bd\s*=\s*\"0\"/i"; sid:90079513; rev:1; metadata:cve CVE-2026-79513, attack.t1499; classtype:attempted-dos; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79513;)

This inspects response bodies carrying MPD manifests. If manifests are fetched via request bodies or raw TCP rather than HTTP, adapt the rule to the relevant protocol/port.

Elastic Detection

process where event.type == "start" and
  process.name : ("MP4Box", "gpac", "gpac-dash") and
  (process.exit_code >= 128 and process.exit_code <= 159)

Pairs with an endpoint crash/exit-code telemetry source; tune to the actual GPAC binary names present in the environment and to SIGFPE-derived exit codes.

Splunk SPL Query

index=media OR index=endpoint sourcetype=syslog OR sourcetype=auditd
| eval gpac_proc=if(match(lower(_raw), "(mp4box|gpac-dash|gpac)"), 1, 0)
| where gpac_proc=1 AND (match(_raw, "(?i)signal 8|SIGFPE|floating point exception|division by zero"))
| stats count values(_raw) as evidence by host, process_name
| where count > 0
| sort - count

Focuses on crash/traceback lines indicating SIGFPE or "division by zero" in GPAC-related processes. Adjust sourcetypes to environment.

Wazuh OSSEC Rule

<group name="gpac,cve_2026_79513,">
  <rule id="10079513" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">MP4Box|gpac|gpac-dash</field>
    <field name="process.exit_code">^1[3-5][0-9]$</field>
    <description>CVE-2026-79513: GPAC process terminated abnormally (possible divide-by-zero DoS via crafted MPD SegmentTimeline)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,cve_2026_79513,</group>
  </rule>
</group>

Requires the audit/EDR JSON decoder to be enabled on the monitored host. Exit codes 128–159 correspond to signal-based termination; validate against the deployed agent config.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

   • Treat untrusted MPD manifests as hostile input: do not auto-resolve remote DASH manifests in production GPAC pipelines. Require validation/allowlisting of manifest sources before parsing.
   • Isolate GPAC-based manifest processing in a sandboxed, monitored, resource-limited container/VM so that crashes are contained and observable, and so repeated crashes cannot affect co-tenant workloads.
   • Apply resource caps and restart policies so that a single malformed manifest cannot take down a long-running shared service.
   • Network-filter or chunk-inspect MPD manifest fetch egress/ingress where feasible (pair with the Suricata rule above) to flag zero-valued SegmentTimeline attributes.

2. Patch / upgrade steps

   • The description references fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, but no released version has been confirmed as patched by any tracked source, and the fix has not been linked to a tagged distribution. Do not assume the commit equates to a shipped fix.
   • Monitor the GPAC upstream repository for a tagged release containing commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, and follow the project's security advisories. Until a tagged release exists, treat all GPAC 26.07.0 instances as unpatched.
   • If you build GPAC from source, only apply the referenced commit after validating it in a test environment; document the exact commit and build provenance.

3. Long-term hardening

   • Enforce strict, schema-validated MPD parsing with explicit rejection of zero/negative timing denominators at the ingestion boundary; push fixes upstream for divide-by-zero classes (CWE-369) across the media toolchain.
   • Maintain an SBOM and version inventory for GPAC and other media libraries so that a future patched release can be rolled out quickly.
   • Adopt fuzzing of manifest/DASH parsers in CI to catch divide-by-zero and arithmetic-fault classes before deployment.

References

1. NVD — CVE-2026-79513: https://nvd.nist.gov/vuln/detail/CVE-2026-79513
2. GPAC project source (function gf_dash_get_timeline_duration, src/media_tools/dash_client.c); referenced fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 — verify in the project repository.
3. CWE-369 — Divide By Zero: https://cwe.mitre.org/data/definitions/369.html
4. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-79513 is NOT listed.

Threat actor / in-the-wild note: No public proof-of-concept, exploit code, or in-the-wild exploitation has been observed or published for CVE-2026-79513 as of this report. No threat-actor campaign attribution is available. EPSS has not yet scored this CVE. All exploit-chain content in this report is inferred from the vulnerability class (CWE-369 divide-by-zero) and the NVD description only.