Is CVE-2026-79522 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-79522 being exploited in the wild.

How severe is CVE-2026-79522?

Medium severity, with a CVSS score of 6.5, published 9 September 2026.

Is there a fix for CVE-2026-79522?

A patch was published on 2026-09-09: Fix committed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-79522 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-79522?

Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-79522: GPAC out-of-bounds read in downloader HTTP client

CVE-2026-79522 · Severity: medium · CVSS 6.5 · Published 2026-09-09

GPAC is a multimedia framework that handles streaming and media playback, including HTTP-based content delivery. An out-of-bounds memory read vulnerability in its HTTP downloader allows a remote attacker to crash GPAC by serving a specially crafted HTTP response with an oversized chunk size. This could disrupt media playback for users accessing content from a malicious server or during network-based attacks.

Technologies: Gpac. Vendors: Gpac.

Quick answers

Is CVE-2026-79522 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-79522 being exploited in the wild.
How severe is CVE-2026-79522?: Medium severity, with a CVSS score of 6.5, published 9 September 2026.
Which products and versions are affected?: Gpac v26.07.0.
Is there a fix for CVE-2026-79522?: A patch was published on 2026-09-09: Fix committed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-79522 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-79522?: Check whether you run Gpac at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an out-of-bounds read in the gf_dm_get_chunk_data and gf_dm_data_received functions (src/utils/downloader.c) that parse HTTP Transfer-Encoding: chunked responses. When a chunk size field of 0xFFFFFFFF (4GB-1) is received, it is accepted without upper-bound validation. A subsequent bounds check is bypassed via unsigned 32-bit integer wraparound (hdr_size + nbBytes wraps to a small value), causing a memcpy call to attempt reading 0xFFFFFFFF bytes from a ~4KB heap buffer. The attack requires network reachability to an HTTP server controlled by the attacker or a MITM position. Exploitation results in a deterministic process crash (SIGSEGV) due to reading far beyond allocated memory. A fix was committed in GPAC (commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640).

Affected products

GPAC GPAC v26.07.0

Timeline

2026-08-19: disclosed: Vulnerability reported on GitHub issue #3861
2026-09-09: patched: Fix committed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640
2026-09-09: advisory: CVE-2026-79522 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.