Is CVE-2026-71614 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-71614 being exploited in the wild.

How severe is CVE-2026-71614?

High severity, with a CVSS score of 8.4, published 9 September 2026.

Which products and versions are affected?

Gpac prior to 0e4093392e1f847c90d20e031e893cd942fef938 (c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and earlier).

Is there a fix for CVE-2026-71614?

A patch was published on 2026-09-09: Fix merged in commit 0e4093392e1f847c90d20e031e893cd942fef938 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-71614 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-71614?

Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-71614: GPAC integer underflow in dvb_mpe.c

CVE-2026-71614 · Severity: high · CVSS 8.4 · Published 2026-09-09

GPAC is an open-source multimedia framework used to process and playback digital media files, including broadcast video streams. An integer underflow vulnerability in its DVB-MPE component allows a malicious media file to trigger a memory allocation failure, crashing the application and causing a denial of service. The vulnerability affects versions prior to the patched commit and can be triggered by opening a specially crafted video file.

Technologies: Gpac. Vendors: Gpac.

Quick answers

Is CVE-2026-71614 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-71614 being exploited in the wild.
How severe is CVE-2026-71614?: High severity, with a CVSS score of 8.4, published 9 September 2026.
Which products and versions are affected?: Gpac prior to 0e4093392e1f847c90d20e031e893cd942fef938 (c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and earlier).
Is there a fix for CVE-2026-71614?: A patch was published on 2026-09-09: Fix merged in commit 0e4093392e1f847c90d20e031e893cd942fef938 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71614 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-71614?: Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an integer underflow in dvb_mpe.c affecting the descriptorTime_slice_fec_identifier() and gf_m2ts_ipdatagram_reader() functions. When parsing crafted DVB INT table descriptors or UDP datagram sections, an 8-bit or 32-bit size value is subtracted without validation, causing wrap-around when the value is smaller than the subtraction amount (e.g., 1 - 3 wraps to 0xFFFFFFFFFFFFFFFE). This causes gf_malloc() to be called with an impossibly large allocation size, which fails and crashes the process. The attack is triggered by crafting a malicious Transport Stream (TS) file with a time_slice_fec descriptor (tag 0x77) of length 1 byte. No authentication or user interaction beyond opening the file is required; the vulnerability is not believed to be exploitable for code execution, only denial of service. A fix is available in commit 0e4093392e1f847c90d20e031e893cd942fef938, which adds bounds checks before the subtraction operations.

Affected products

GPAC GPAC prior to 0e4093392e1f847c90d20e031e893cd942fef938 (c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 and earlier)

Timeline

2026-06-11: disclosed: Vulnerability reported via GitHub issue #3614
2026-09-09: patched: Fix merged in commit 0e4093392e1f847c90d20e031e893cd942fef938
2026-09-09: advisory: CVE-2026-71614 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.