CVE-2026-79514: Medium severity Gpac GPAC vulnerability

Published Sep 9, 2026

Updated

An out-of-bounds read in the gfdmdatareceived function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

Affected Software

1 affected component

Gpac GPAC=26.07.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640

Event History

Sep 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs network access to send a crafted HTTP request and user interaction is required. No privileges are required.

What is the practical impact?

Successful exploitation can cause a denial of service through an out-of-bounds read in the downloader component. The available data does not indicate confidentiality or integrity impact.

Which release is identified as affected, and what fixes it?

GPAC v26.07.0 is identified as affected. The issue is fixed by commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640.