CVE-2026-79513 in GPAC
Summary
by MITRE • 09/09/2026
A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as CVE-2023-something involves a critical arithmetic error within the GPAC multimedia framework, specifically located in the gf_dash_get_timeline_duration function found in the src/media_tools/dash_client.c source file. This flaw is categorized under CWE-369, which denotes divide-by-zero errors that can lead to application crashes or unexpected behavior. The vulnerability arises when processing a crafted Media Presentation Description (MPD) SegmentTimeline element within an MPEG-DASH stream. An attacker who controls the content of this MPD file can construct a malicious timeline configuration where the divisor used in duration calculations evaluates to zero, triggering a fatal exception during runtime execution.
From a technical perspective, the gf_dash_get_timeline_duration function is responsible for calculating the total duration of media segments based on the information provided in the DASH manifest. When parsing the SegmentTimeline element, the software performs arithmetic operations to determine segment lengths and offsets. If an attacker provides specific values that result in a division by zero operation, such as setting certain timing parameters to create a null divisor, the application fails to handle this edge case gracefully. Instead of returning an error code or handling the exception internally, the unhandled mathematical error causes the process to terminate abruptly. This behavior is consistent with CWE-475, which involves base64 decoding errors leading to buffer overflows, although in this specific instance, it manifests as a direct arithmetic failure rather than memory corruption, though both can lead to similar denial of service outcomes depending on the execution environment and compiler optimizations.
The operational impact of this vulnerability is primarily focused on Denial of Service (DoS). Since GPAC is often used by media servers or clients to parse and stream DASH content, a successful exploit allows an attacker to crash the application simply by providing a malicious MPD file for parsing. This disruption prevents legitimate users from accessing multimedia services hosted or processed by vulnerable instances of GPAC. In scenarios where GPAC operates as part of a larger streaming infrastructure, such crashes can lead to service outages, requiring manual intervention to restart affected processes and potentially causing data loss if state was not persisted before the crash. The impact is classified under MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically reflecting resource exhaustion or application instability caused by malformed input rather than overwhelming system resources with volume.
Mitigation strategies for this vulnerability involve updating to a patched version of GPAC where the arithmetic operations are safeguarded against invalid inputs. The fix was introduced in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, which likely includes validation checks to ensure that divisors are non-zero before performing division operations or implements exception handling mechanisms to catch and manage such errors without crashing the application. Organizations relying on GPAC for media processing should prioritize applying this patch immediately. Additionally, implementing input sanitization at network ingress points can provide an additional layer of defense by filtering out malformed MPD files before they reach the vulnerable component. Regular security audits and code reviews focusing on arithmetic operations in multimedia parsers are recommended to prevent similar vulnerabilities from being introduced in future updates.