Description

A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD SegmentTimeline. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T21:17:04.150Z",
  "pubdate": "2026-09-09T21:17:04.150Z",
  "executiveSummary": "The GPAC multimedia framework, specifically version 26.07.0, is susceptible to a denial-of-service (DoS) vulnerability originating from an unchecked arithmetic operation.\nThe flaw exists within the gf_dash_get_timeline_duration function, which processes DASH (Dynamic Adaptive Streaming over HTTP) MPD (Media Presentation Description) files.\nAn attacker can exploit this by crafting a malicious MPD SegmentTimeline that triggers a division-by-zero error, leading to an immediate application crash.\nThis vulnerability poses a significant risk to the availability of systems relying on GPAC for stream parsing, as the process cannot recover from this floating-point or integer exception without external intervention.\nExploitation does not require prior authentication or elevated privileges, provided the attacker can force the client to parse the malformed segment information.\nThe impact is limited to service disruption and application termination, with no reported potential for remote code execution or unauthorized data access.",
  "technicalDetails": "The vulnerability resides in src/media_tools/dash_client.c within the function gf_dash_get_timeline_duration. The root cause is a failure to perform input validation on duration or repeat parameters defined within the SegmentTimeline element of an MPD file.\nDuring the parsing process, the function performs arithmetic operations—specifically division—using values derived directly from the MPD metadata. When the segment timeline provides a zero value for a denominator, the underlying hardware or software runtime environment triggers an arithmetic exception, specifically a divide-by-zero signal (SIGFPE on POSIX systems).\nThe attack flow begins when the GPAC-based client initiates a fetch for a remote or local MPD file. The attacker hosts or provides a crafted MPD file where the SegmentTimeline properties are intentionally manipulated to force a division by zero during the calculation of total timeline duration.\nAs the gf_dash_get_timeline_duration function processes the timeline structure, it fails to verify that the divisor is non-zero before passing the data to the arithmetic operation. Because the application logic does not implement robust error handling or safety checks for these specific segment parameters, the operating system kernel sends an interrupt that terminates the GPAC process.\nThis vulnerability is classified as a classic application-level denial-of-service. Since the parsing logic is inherent to the core dash client component of GPAC, any application linking against this library is inherently vulnerable. The exploitation does not require the attacker to possess specific system privileges or bypass memory protections, as the crash is an expected consequence of the unhandled exception.\nThe issue remains effective in scenarios where GPAC is utilized in automated streaming pipelines, media transcoders, or client-side video players. Remediation is addressed in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, which introduces defensive logic to validate the integrity of timeline parameters before executing sensitive arithmetic operations."
}