CVE-2026-79514

Executive Summary

CVE-2026-79514 is an out-of-bounds read in the gf_dm_data_received function in downloader.c of GPAC v26.07.0, the open-source multimedia framework. A remote, unauthenticated attacker can trigger the flaw by delivering a crafted HTTP request to a GPAC component that exercises the downloader subsystem, causing a crash that results in a Denial of Service (DoS). The CVSS 3.1 base score is 6.5 (Medium), driven by Network attack vector, Low attack complexity, No privileges required, User Interaction Required, and High availability impact with no confidentiality or integrity impact. No public proof-of-concept, exploit code, or Nuclei template is currently available, and there is no evidence of exploitation in the wild or CISA KEV listing.

Technical Analysis

GPAC is a widely deployed open-source multimedia framework used for MPEG-DASH, HLS, ISOBMFF, and related streaming/broadcast pipelines; it also underpins GUI and server-side tooling (e.g., MP4Box and the GPAC filter framework) and is embedded in streaming, transcoding, and player applications across desktop and server environments.

The vulnerability is an out-of-bounds read (CWE-125) localized to the gf_dm_data_received function in downloader.c. The downloader.c module implements GPAC's download manager, which is responsible for fetching remote resources — manifests, media segments, subtitles, and related objects — over HTTP and handing received buffers into the filter graph. The gf_dm_data_received callback handles data as it is returned by the underlying HTTP library during an in-progress transfer.

An out-of-bounds read in a receive callback typically arises when the code computes a buffer or pointer position from an attacker-controllable value in the HTTP response stream — for example a Content-Length header, a chunk size, a redirect/Location value, or a range-related header — and then dereferences past the end of the actually received bytes. Because the attacker controls the server side of the request, they can craft HTTP responses that violate assumptions the download manager makes about size and framing. When the crafted response is processed, gf_dm_data_received reads memory outside the allocated buffer.

The NVD description does not disclose the specific header, field, or byte offset at which the bounds check fails; that level of implementation detail is not available in the source data and is not asserted here. What is clear from the advisory is (a) the vulnerable function and file, (b) that attacker control is exercised via "sending a crafted HTTP request," and (c) that the resulting defect class is an out-of-bounds read.

The immediate consequence of an out-of-bounds read of this type is most commonly a crash (SIGSEGV) via read of unmapped memory, which yields the DoS that the CVE describes. It can also, in principle, lead to information disclosure if the over-read bytes are subsequently returned to output or leaked via a log — however, the CVSS vector records C:N (no confidentiality impact), so the assessed primary impact in this CVE is availability only. No write primitive, no code execution, and no integrity impact are described.

The affected artifact is GPAC v26.07.0. A fix has been committed upstream as 2fd5a06ab226767900fd86edb5a1e8bfc1010640, but mapping that commit to a specific tagged release is not possible from the data provided; users should confirm build provenance against the commit hash rather than assume any released version number is safe.

Exploitation Scenarios

No public PoC exists for CVE-2026-79514; the attack chain below is inferred from the vulnerability class (network-triggerable OOB read in an HTTP data-receive path) and from the NVD statement that a "crafted HTTP request" triggers the flaw. No specific payload bytes, header names, or function internals beyond those stated are asserted.

1. Reconnaissance and target identification. An attacker identifies a reachable GPAC endpoint that performs HTTP retrieval through the download manager. GPAC is commonly found in streaming servers, remote-transcoding pipelines, and applications or services that ingest remote manifests/segments, as well as in desktop players or CLI tooling that a victim is induced to point at an attacker-controlled URL. Public IP-based scanning for listening GPAC-related HTTP services can be performed with the Shodan dorks in the METADATA section; alternatively, the attacker positions an arbitrary HTTP host as the "server" that a GPAC-based client will fetch from.

2. Triggering the flaw. The core requirement is that GPAC's downloader calls gf_dm_data_received on attacker-supplied response data. In a client-side scenario, the attacker hosts a malicious resource (manifest or media URL) and causes the victim's GPAC-based application to request it — this is why the CVSS vector carries UI:R: a user must be induced to open or load a link pointing at the attacker's server (e.g., a crafted media stream URL). The attacker's HTTP server then responds with a crafted body/header sequence that violates the download manager's assumptions about length or framing, so that the receive callback advances past the end of the valid buffer.

3. Execution method (class level). The exploit is delivered over the network as an HTTP response; the "request" referenced by the advisory is the HTTP transaction in which the malicious response is returned to GPAC. No shell, authentication, or privileged access is required on the GPAC host (PR:N) and no exploit code is published.

4. Post-exploitation impact. Successful triggering produces an out-of-bounds read that, per the CVE's impact assessment, manifests as a crash — Denial of Service — of the GPAC process. Per the CVSS vector there is no integrity or confidentiality impact demonstrated. Repeated or scripted triggering against a service could sustain an availability outage; for a desktop/client deployment it results in an application crash.

Note: no exploit code, no PoC, no Nuclei template, and no in-the-wild telemetry are available for this CVE as of this report.

Impact Assessment

• CVSS 3.1 base score: 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
• AV:N — the flaw is reachable across a network boundary through an HTTP transaction.
• AC:L — no special conditions beyond delivering the crafted HTTP response are described.
• PR:N — no authentication is required on the vulnerable GPAC host.
• UI:R — exploitation requires the GPAC client to be directed to the attacker's resource, hence user interaction.
• S:U — impact remains scoped to the GPAC component's security authority.
• C:N — no confidentiality impact is assessed (no confirmed information leak is claimed in the vector).
• I:N — no integrity impact: it is a read, not a write.
• A:H — the confirmed outcome is availability loss (crash) of the affected component.

Business impact. GPAC is frequently embedded in media processing and streaming infrastructure. A process-level DoS can interrupt live transcoding, packaging, or streaming workflows, and in hardened pipelines where GPAC-parsing is the entry to downstream processing, a crash may stall an entire job queue. Blast radius is limited to the specific GPAC process (S:U); there is no described lateral movement, no code execution, and no data modification. Availability is the material business risk — SLA breach, pipeline stall, and user-facing crashes in client software.

Exposure considerations. GPAC's presence in third-party players and CLI tooling means the effective attack surface extends wherever a GPAC-based tool can be induced to fetch an attacker-controlled URL. Given no public exploit and no KEV listing, current risk is assessed as Moderate/CVE-class rather than actively exploited.

Detection Guidance

Sigma Rule

No public exploit exists, so this rule targets the observable consequence: abnormal crash/segfault behavior of GPAC-based processes. It surfaces repeated unexpected process termination associated with GPAC binaries, which is the expected artifact of triggering the OOB read.

title: GPAC Process Crash Consistent with CVE-2026-79514 Out-of-Bounds Read
id: 9a4c1d2e-5b6f-4f27-9d1c-gpac79514do
status: experimental
description: Detects repeated unexpected termination of GPAC-based processes (e.g., MP4Box, gpac) potentially caused by an out-of-bounds read in gf_dm_data_received triggered by a crafted HTTP response.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79514
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_binary:
    - Image|endswith:
        - '/gpac'
        - '/MP4Box'
        - '/gpac.exe'
        - '/MP4Box.exe'
  selection_crash:
    - Outcome: 'Crash'
    - EventID: 1000   # Windows Application Error
  condition: selection_binary and selection_crash
falsepositives:
  - Legitimate crashes from malformed inputs unrelated to this CVE
level: medium
tags:
  - attack.t1499
  - cve.2026.79514

YARA Rule

Because no exploit artifacts exist, this rule hedges pragmatically: it identifies GPAC binaries and harness/driver files that reference the vulnerable function path and the fixed commit — useful to confirm which hosts are still on the vulnerable code (triage of internal test corpora, fixtures, and build metadata).

rule GPAC_CVE_2026_79514_Vulnerable_Downloader
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects GPAC source/binaries referencing downloader.c / gf_dm_data_received prior to the fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640"
        cve = "CVE-2026-79514"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79514"
        date = "2026-01-01"

    strings:
        $s1 = "gf_dm_data_received" ascii
        $s2 = "downloader.c" ascii
        $fixed = "2fd5a06ab226767900fd86edb5a1e8bfc1010640" ascii
        $ver = "26.07.0" ascii

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F) // PE or ELF
        and any of ($s1, $s2)
        and $ver
        and not $fixed
}

Suricata IDS Rule

Targets overly large or malformed HTTP responses to GPAC-associated services that could supply the crafted data reaching the download callback. Adjust $HOME_NET and ports to your deployment.

alert http $EXTERNAL_NET any -> $HOME_NET [8080,8443,80,443] (msg:"CVE-2026-79514 GPAC downloader.c possible crafted HTTP response triggering OOB read"; flow:established,to_client; http.response_body; content:"|00|"; depth:1; pcre:"/Content-Length\s*:\s*([1-9][0-9]{7,})/Hi"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-79514; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79514; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:202679514; rev:1;)

Elastic Detection

EQL process rule to correlate GPAC process termination with a preceding outbound HTTP connection to an uncommon remote host — the typical shape of a client induced to fetch an attacker-controlled resource.

process where process.name in ("gpac", "MP4Box", "gpac.exe", "MP4Box.exe")
  and event.action in ("process-exited", "end")
  and process.exit_code != 0

Pair with a network correlation in EQL:

sequence by host.id with maxspan=60s
  [ network where process.name in ("gpac", "MP4Box") and network.direction == "egress"
      and network.protocol == "http" and destination.port in (80, 8080, 443, 8443) ]
  [ process where process.name in ("gpac", "MP4Box") and event.action == "process-exited"
      and process.exit_code != 0 ]

Splunk SPL Query

Detect GPAC process crashes (SIGSEGV) and correlate with the responsible remote host where logs permit. Adjust index/sourcename to your environment.

index=* (Image="*gpac*" OR Image="*MP4Box*" OR process_name IN ("gpac","MP4Box"))
  (Outcome="Crash" OR EventCode=1000 OR message="*SIGSEGV*" OR message="*segfault*")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest) as dst values(host) as host by process_name, Image
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Wazuh OSSEC Rule

Detects repeated GPAC process crashes via syslog/kernel logs, which follow from the OOB read described in the CVE.

<group name="gpac,cve_2026_79514,">
  <rule id="10079514" level="10">
    <decoded_as>syslog</decoded_as>
    <match>segfault|SIGSEGV|general protection fault</match>
    <regex>gpac|MP4Box</regex>
    <description>CVE-2026-79514: GPAC process crash (possible out-of-bounds read in gf_dm_data_received/downloader.c)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,cve_2026_79514,</group>
  </rule>
  <rule id="10079515" level="12" frequency="3" timeframe="300">
    <if_matched_sid>10079514</if_matched_sid>
    <same_source_ip/>
    <description>CVE-2026-79514: repeated GPAC crashes from the same source (likely sustained DoS attempt)</description>
    <group>dos,cve_2026_79514,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix mapping, no workarounds, and no affected-version list are provided in the source data.

1. Immediate mitigations

• Isolate GPAC-based processing from untrusted network origins where feasible: restrict outbound HTTP(S) from GPAC hosts to an allowlist of trusted media/CDN origins, so the attacker's "crafted HTTP response" server is unreachable.
• Do not process manifests, media URLs, or resources supplied by untrusted or user-provided links (mitigates the UI:R precondition — a user must be directed at the malicious resource).
• Deploy the Suricata rule above on the network boundary in front of GPAC hosts; apply the Sigma/Wazuh rules to detect crash-based DoS.
• Where GPAC runs in a long-lived service, configure supervised auto-restart and alert on frequent restarts; for client deployments, keep crash reporting enabled for telemetry.
• Apply least-privilege runtime: run GPAC processes as a dedicated unprivileged account/container so a crash has minimal collateral effect.

2. Patch / upgrade steps

• Apply the upstream fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. Because no tagged release has been confirmed to contain this commit, do not assume a version number is fixed; verify the commit hash in your build provenance.
• If consuming GPAC via a distribution package or a downstream application, open a vendor ticket requesting backport of the fix commit and confirm the backport hash.
• Rebuild/redeploy any GPAC-based component (server, transcoder, CLI tool, embedded player) after patching; restart services to drop vulnerable image layers.

3. Long-term hardening

• Maintain an SBOM and track GPAC versions/commit hashes per deployment to detect drift away from the fixed commit.
• Enforce network allowlisting and egress filtering for media-processing hosts, and pin/verify TLS on remote-fetch endpoints to raise the bar for response-tampering attacks.
• Fuzz the download/HTTP path (downloader.c) as part of your own supply-chain assurance, since the upstream fix is a single bounds check that is easy to regress.
• Reduce single points of failure: decouple media-fetch from media-parse via sandboxed subprocesses or containers and instrument for crash telemetry to earlier-detect DoS-class bugs.

References

• NIST NVD — CVE-2026-79514: https://nvd.nist.gov/vuln/detail/CVE-2026-79514
• GPAC upstream project (fix commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640) — verify against the official GPAC repository and release notes: https://github.com/gpac/gpac
• FIRST EPSS — not yet scored for this CVE (no value fabricated): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities catalog — CVE-2026-79514 is NOT listed as of this report: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CWE-125, Out-of-bounds Read (CWE class description for the underlying defect): https://cwe.mitre.org/data/definitions/125.html

Threat actor campaigns / exploitation-in-the-wild: none. No PoC, no exploit code, no Nuclei template, no KEV listing, and no threat-actor telemetry are associated with CVE-2026-79514 in the source data.