CVE-2026-79522: Medium severity Gpac GPAC vulnerability

Published Sep 9, 2026

Updated

An out-of-bounds read in the gfdmgetchunkdata function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

Affected Software

1 affected component

Gpac GPAC=26.07.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GPAC to a version that resolves this vulnerability.
Fixed in 26.07.0Patch 2fd5a06ab226767900fd86edb5a1e8bfc1010640

Event History

Sep 9, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverity

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to send a crafted HTTP request and induce user interaction. No authentication or existing privileges are required.

What is the impact of successful exploitation?

Successful exploitation can cause a denial of service through an out-of-bounds read in gf_dm_get_chunk_data. The provided data does not indicate confidentiality or integrity impact.

Which GPAC version is identified as affected?

The issue is reported in GPAC v26.07.0. The supplied data identifies commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 as the fix.