CVE-2026-14801: GPAC TeXML File load_text.c txtin_probe_duration divide by zero
A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtinprobeduration of the file src/filters/loadtext.c of the component TeXML File Handler. Such manipulation of the argument txmltimescale leads to divide by zero. An attack has to be approached locally. The name of the patch is 86a5191f2e750c767253e27ed6cfd6d547afebc2. A patch should be applied to remediate this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GPAC TeXML File Handler (src/filters/load_text.c)to a version that resolves this vulnerability.Fixed in 26.03-DEV-rev342-g80071f700-masterPatch 86a5191f2e750c767253e27ed6cfd6d547afebc2 - Configuration
Since manipulating txml_timescale leads to divide by zero in txtin_probe_duration, ensure txml_timescale is validated/handled safely (e.g., prevent zero or unsafe values) when parsing TeXML.
TeXML File Handler (function txtin_probe_duration in src/filters/load_text.c) txml_timescale = Validate/limit txml_timescale input so it cannot cause divide by zero - Compensating control
Approach the attack locally as stated in the advisory (attack must be approached locally).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14801?
The severity of CVE-2026-14801 is classified as low with a score of 3.3.
How does CVE-2026-14801 affect GPAC?
CVE-2026-14801 affects GPAC by introducing a divide by zero vulnerability in the function txtin_probe_duration of the TeXML File Handler.
What is the potential impact of CVE-2026-14801?
The potential impact of CVE-2026-14801 includes application crashes or unexpected behavior due to the divide by zero error.
How can I mitigate the risk of CVE-2026-14801?
To mitigate the risk of CVE-2026-14801, ensure you are using a patched version of GPAC that addresses this vulnerability.
When was CVE-2026-14801 published?
CVE-2026-14801 was published on July 6, 2026.