Description

An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-09T21:17:04.683Z",
  "pubdate": "2026-09-09T21:17:04.683Z",
  "executiveSummary": "This vulnerability involves an out-of-bounds (OOB) read flaw within the GPAC multimedia framework, specifically residing in the chunk data processing logic of the downloader utility.\nThe issue is classified as an out-of-bounds read, which occurs when the application reads data past the end of an intended buffer, leading to potential memory access violations.\nThe primary impact of this vulnerability is a Denial of Service (DoS), where a remote, unauthenticated attacker can crash the application by supplying a maliciously crafted HTTP request.\nGPAC version 26.07.0 is confirmed to be affected by this flaw.\nThe risk implication is significant for deployments utilizing GPAC for network-based media streaming or processing, as the vulnerability is reachable over the network and requires no special privileges to exploit.\nThe exploit requires the victim application to process a specially prepared HTTP request, which triggers the unsafe read operation within the downloader component.\nSuccessful exploitation forces an immediate termination of the process, disrupting service availability.",
  "technicalDetails": "The vulnerability is located in the gf_dm_get_chunk_data function within src/utils/downloader.c. This function is responsible for retrieving and processing segments or chunks of data during HTTP-based downloads.\nThe root cause of the flaw is an insufficient boundary check when accessing internal buffers during the parsing or handling of HTTP response data. When a crafted HTTP request triggers an atypical response or specific chunk encoding, the function fails to validate the length of the data being read against the allocated buffer size.\nExploitation is achieved by transmitting a crafted HTTP request to a GPAC-based client or server configured to use the affected downloader utility. The attacker embeds malicious parameters or unexpected data structures within the HTTP headers or response body that mislead the gf_dm_get_chunk_data logic into performing an out-of-bounds memory read.\nDuring execution, when the function attempts to process the incoming chunk, the pointer arithmetic or index calculation utilized for buffer access exceeds the authorized memory range. Because the application lacks the necessary validation logic to confirm the integrity of these offsets, the process attempts to read data from adjacent memory segments.\nIn environments where memory protections are standard, this illegal memory access typically results in a segmentation fault, leading to a crash and an effective Denial of Service. In some architectural contexts, this could potentially lead to information disclosure if sensitive data residing in the adjacent memory is returned or leaked via the application response, though the primary observed impact remains process instability.\nThe vulnerability is reachable remotely, and no authentication or specific privilege level is required for an attacker to trigger the crash. The lack of bounds checking represents a failure in secure input handling during the data ingestion phase of the HTTP download process.\nAffected version: GPAC v26.07.0. The vulnerability was addressed in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640, which introduces proper boundary validation to ensure that buffer access remains within the allocated memory limits, thereby preventing the out-of-bounds read condition."
}