Executive brief
GPAC is a multimedia framework that handles streaming and media playback, including HTTP-based content delivery. An out-of-bounds memory read vulnerability in its HTTP downloader allows a remote attacker to crash GPAC by serving a specially crafted HTTP response with an oversized chunk size. This could disrupt media playback for users accessing content from a malicious server or during network-based attacks.
Technical details
The vulnerability is an out-of-bounds read in the gf_dm_get_chunk_data and gf_dm_data_received functions (src/utils/downloader.c) that parse HTTP Transfer-Encoding: chunked responses. When a chunk size field of 0xFFFFFFFF (4GB-1) is received, it is accepted without upper-bound validation. A subsequent bounds check is bypassed via unsigned 32-bit integer wraparound (hdr_size + nbBytes wraps to a small value), causing a memcpy call to attempt reading 0xFFFFFFFF bytes from a ~4KB heap buffer. The attack requires network reachability to an HTTP server controlled by the attacker or a MITM position. Exploitation results in a deterministic process crash (SIGSEGV) due to reading far beyond allocated memory. A fix was committed in GPAC (commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640).
Affected products
- GPAC GPAC v26.07.0
Timeline
- 2026-08-19: disclosed: Vulnerability reported on GitHub issue #3861
- 2026-09-09: patched: Fix committed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640
- 2026-09-09: advisory: CVE-2026-79522 published