Description

An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T21:17:04.273Z",
  "pubdate": "2026-09-09T21:17:04.273Z",
  "executiveSummary": "An out-of-bounds (OOB) read vulnerability exists in the gf_dm_data_received function within the GPAC v26.07.0 downloader component. This memory safety flaw allows a remote, unauthenticated attacker to trigger a Denial of Service (DoS) condition by supplying a maliciously crafted HTTP request.\nThe vulnerability occurs during the processing of incoming data streams, where insufficient bounds checking results in the application accessing memory regions outside of allocated buffer boundaries. Successful exploitation typically causes the application to crash, resulting in service disruption. As the defect resides in the data reception logic, it is exposed to any network-accessible instance of the affected product. Organizations utilizing GPAC for media processing or streaming should prioritize remediating this issue to ensure service availability and prevent potential memory disclosure incidents arising from uncontrolled read operations.",
  "technicalDetails": "The vulnerability is localized within the gf_dm_data_received function of the downloader.c source file. The root cause is an improper validation of data offsets or lengths during the reception of HTTP-based media content. When the GPAC library processes a specially crafted HTTP response, the downloader logic fails to correctly calculate the boundaries of the incoming data payload relative to the allocated destination buffer.\nDuring the execution of gf_dm_data_received, the program attempts to read data from an input stream into a memory buffer. If the crafted HTTP request specifies an unexpected data size or offset, the logic proceeds to perform a read operation beyond the valid range of the allocated heap or stack space. Because the software lacks the necessary bounds verification to ensure that the read pointer remains within the designated memory block, it performs an out-of-bounds read access.\nThe attack flow proceeds as follows: An attacker initiates an HTTP connection to a service utilizing the affected GPAC library. The attacker then sends a crafted HTTP payload designed to trigger the specific parsing logic within gf_dm_data_received that leads to the OOB condition. As the library attempts to interpret the payload, the internal pointer logic navigates outside the intended buffer address space. This leads to an immediate memory access violation, typically resulting in a segmentation fault or a process crash, effectively resulting in a Denial of Service. In scenarios where the read operation does not immediately crash the application, there remains a potential for information disclosure if the OOB read allows the application to process or transmit sensitive data residing in adjacent memory segments.\nThe vulnerability affects GPAC v26.07.0. The lack of proper input sanitization and length verification during the downloader's data ingestion phase indicates a failure in robust input handling for network protocols. Exploitation is possible remotely without authentication or high-level privileges, as the downloader module is inherently designed to ingest untrusted data from external network sources. The issue has been addressed in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, which presumably implements necessary boundary checks to validate that read operations stay within the defined limits of the memory buffers before data processing begins."
}