CVE-2026-79522

Executive Summary

CVE-2026-79522 is an out-of-bounds read vulnerability in the gf_dm_get_chunk_data function within src/utils/downloader.c of GPAC v26.07.0. A remote, unauthenticated attacker can trigger the flaw by sending a crafted HTTP request, causing a Denial of Service (DoS) condition. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium severity), with high availability impact but no confidentiality or integrity impact. No public proof-of-concept, exploit code, or Nuclei template is currently available.

Technical Analysis

GPAC (formerly known as MP4Box) is an open-source multimedia framework used for processing, packaging, streaming, and playback of media content across formats such as MP4, DASH, HLS, and others. It is widely embedded in media pipelines, transcoding services, and research tooling.

The vulnerability resides in the downloader utility module at src/utils/downloader.c, specifically in the gf_dm_get_chunk_data function. This function is responsible for retrieving chunk data during HTTP-based downloads — a core operation when GPAC fetches remote media segments (e.g., DASH/HLS fragments or progressive downloads).

The NVD description states that a crafted HTTP request triggers an out-of-bounds read (CWE-125). An out-of-bounds read occurs when a program reads memory beyond the allocated buffer boundary. In the context of a downloader function that parses server responses or request metadata, this typically manifests when:

1. The attacker controls response headers or content length values that do not match the actual data buffer.
2. A length or offset field is used to index into a buffer without adequate bounds validation before the read operation.
3. Malformed chunked-transfer encoding or an unexpected HTTP response structure causes the downloader to read past the end of a heap-allocated buffer.

Because the flaw is classified as an out-of-bounds read rather than a write, the primary consequence is information disclosure or, more commonly in this class, a process crash when the read crosses into unmapped memory. Per the CVSS vector, the impact is limited to availability (A:H), with confidentiality and integrity unaffected (C:N/I:N/A:H).

The attack requires user interaction (UI:R) per the CVSS vector, consistent with scenarios where an application or user directs GPAC to process a malicious URL or remote resource. The attack vector is network (AV:N), complexity is low (AC:L), and no privileges are required (PR:N).

Insufficient technical detail is available regarding the exact buffer management logic or the precise bytes needed to trigger the over-read. The description does not disclose specific parameter names, HTTP headers, or response formats beyond the "crafted HTTP request" characterization.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-125 out-of-bounds read) and the function's role as described in the NVD entry.

1. Reconnaissance / Target Identification: An attacker identifies a target environment where GPAC v26.07.0 is used to fetch or process remote media resources over HTTP. This includes DASH/HLS streaming infrastructure, automated media ingestion services, or any application invoking GPAC's downloader against attacker-influenced URLs.

2. Triggering the Flaw: The attacker crafts an HTTP request/response interaction that targets the gf_dm_get_chunk_data code path. Based on the class of the vulnerability, this likely involves supplying a malicious HTTP endpoint (or man-in-the-middle position) that returns a response whose structure causes GPAC's downloader to compute a read length or offset that exceeds the actual buffer. The NVD description explicitly frames the trigger as "sending a crafted HTTP request," meaning the attacker may directly control the request to a GPAC-exposed service or control the server that GPAC connects to.

3. Execution / Payload Method: The attacker does not need to write a memory payload (this is not an out-of-bounds write). The "payload" is the malformed HTTP interaction that drives GPAC to read past a buffer boundary. When the out-of-bounds read hits an unmapped page, the process receives a segmentation fault and terminates.

4. Post-Exploitation Impact: The immediate result is a crash of the GPAC process handling the download — a Denial of Service. If GPAC runs as a shared service (e.g., a streaming server or transcoding worker), repeated triggering can cause sustained unavailability. No code execution or data exfiltration is demonstrated by this vulnerability class, and the CVSS vector confirms no confidentiality or integrity impact.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium), with the following subscores:

• Attack Vector (AV:N): Exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions required; low complexity.
• Privileges Required (PR:N): No authentication needed.
• User Interaction (UI:R): Some user or application action is required to initiate the download of attacker-controlled content.
• Scope (S:U): Impact is confined to the vulnerable component.
• Confidentiality (C:N): No confidentiality impact.
• Integrity (I:N): No integrity impact.
• Availability (A:H): High availability impact — process crash/DoS.

Business impact: Organizations running GPAC v26.07.0 in media processing pipelines, streaming backends, or automated content ingestion workflows face service disruption. A single crash takes down the affected process; if GPAC handles concurrent download operations, a crafted request can abort an entire batch job. Because there is no data corruption or exfiltration, the impact is operational rather than data-breach related.

Blast radius: Limited to instances where GPAC processes HTTP-fetched content. Environments that only use GPAC on locally stored files are not exposed. There is no lateral movement risk from this specific flaw.

Note: No EPSS score is available (not yet scored by FIRST.org). CISA KEV status: NO. No exploit code or PoC is publicly tracked.

Detection Guidance

Sigma Rule

title: GPAC gf_dm_get_chunk_data Out-of-Bounds Read DoS Attempt
id: 3f9c1a2e-8d4b-4e7a-9c1f-6b2d5e8a7f30
status: experimental
description: Detects process crashes of GPAC (MP4Box) consistent with CVE-2026-79522 out-of-bounds read triggered by crafted HTTP responses.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79522
author: valtersit.com
date: 2026/07/01
tags:
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/MP4Box'
      - '/gpac'
  selection_crash:
    EventType: 'segfault'
  condition: selection_process and selection_crash
falsepositives:
  - Genuine memory corruption from unrelated bugs
  - Fuzzing or test workloads
level: medium

YARA Rule

rule CVE_2026_79522_GPAC_Downloader_OOB_Read
{
    meta:
        description = "Detects GPAC v26.07.0 binaries containing the vulnerable downloader chunk read logic (CVE-2026-79522)"
        author = "valtersit.com"
        date = "2026-07-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79522"
        severity = "medium"

    strings:
        $fn = "gf_dm_get_chunk_data" ascii
        $file = "downloader.c" ascii
        $ver = "26.07.0" ascii

    condition:
        uint32(0) == 0x464c457f and // ELF
        $fn and
        ($file or $ver)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79522 GPAC gf_dm_get_chunk_data Out-of-Bounds Read Attempt"; flow:established,to_client; content:"Content-Length"; http_header; pcre:"/Content-Length\x3a\s*\d{8,}/Hi"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; reference:cve,2026-79522; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79522; sid:202679522; rev:1;)

Elastic Detection

process where event.action == "process-crashed" and
  process.name in ("MP4Box", "gpac", "gpac.exe") and
  process.command_line : "*http*"

Splunk SPL Query

index=main (process_name="MP4Box" OR process_name="gpac")
| search (exit_status="139" OR "segmentation fault" OR "SIGSEGV")
| stats count values(command_line) as cmdline by host, process_name, url
| where count > 0

Wazuh OSSEC Rule

<group name="gpac,cve-2026-79522,">
  <rule id="2026795" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">MP4Box|gpac</field>
    <field name="event.action">process-crashed</field>
    <description>CVE-2026-79522: GPAC process crash detected (possible out-of-bounds read DoS)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
  <rule id="2026796" level="10">
    <match>gf_dm_get_chunk_data|SIGSEGV in downloader</match>
    <description>CVE-2026-79522: GPAC downloader out-of-bounds read signature observed</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Immediate Mitigations:

1. Isolate GPAC-based services from untrusted network input — do not allow GPAC to fetch HTTP content from attacker-controlled or unfiltered external endpoints.
2. Enforce network egress filtering/allowlisting so GPAC can only reach trusted, approved media origins.
3. Deploy the Suricata rule above at network boundaries to flag oversized/anomalous Content-Length responses that could trigger the over-read.
4. Enable automatic restart/supervision (systemd, Kubernetes restartPolicy) for GPAC worker processes to reduce DoS dwell time.
5. Monitor for SIGSEGV (exit code 139) crashes of MP4Box/gpac processes.

Patch/Upgrade Steps:

• The NVD description references a fixing commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, but no vendor advisory or release confirmation was provided in the intelligence data. Verify the fix exists in the GPAC upstream repository (github.com/gpac/gpac) and apply the commit or the next released version.
• Until a verified patched release is confirmed, treat all instances of v26.07.0 as vulnerable.
• Rebuild GPAC from the fixing commit if a tagged release is not yet available.

Long-Term Hardening:

• Integrate memory-safe parsing libraries or fuzz GPAC's downloader code paths (src/utils/downloader.c) continuously.
• Adopt a formal media-ingestion trust model: validate, sanitize, and constrain remote URLs before passing them to GPAC.
• Track GPAC releases and apply security updates promptly; subscribe to the GPAC project's security advisories.
• Apply least-privilege execution for GPAC processes (containers, restricted user) to limit impact if additional vulnerabilities are discovered.

References

1. NVD — CVE-2026-79522: https://nvd.nist.gov/vuln/detail/CVE-2026-79522
2. GPAC upstream repository (fixing commit): https://github.com/gpac/gpac/commit/2fd5a06ab226767900fd86edb5a1e8bfc1010640
3. GPAC project homepage: https://gpac.wp.imt.fr/
4. CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
5. CISA Known Exploited Vulnerabilities Catalog (not listed — CVE-2026-79522 is NOT in KEV as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation evidence: No public proof-of-concept, exploit code, Nuclei template, or evidence of in-the-wild exploitation was identified in the provided intelligence data. No threat actor campaigns are associated with this CVE at the time of writing.