PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-79514 GPAC CVE debrief

A CVE debrief for CVE-2026-79514 was generated based on the supplied source corpus. The vulnerability is an out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0, which allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Defenders responsible for GPAC deployments, particularly those using version 26.07.0, should assess exposure and prioritize verification and potential remediation. The issue was fixed in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. The CVE record and NVD entry provide details on the vulnerability.

Vendor
GPAC
Product
GPAC
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-09
Original CVE updated
2026-09-14
Advisory published
2026-09-09
Advisory updated
2026-09-14

Who should care

Defenders responsible for GPAC deployments, particularly those using version 26.07.0, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-79514 is a medium-severity vulnerability in GPAC v26.07.0 that allows attackers to cause a Denial of Service (DoS) via crafted HTTP requests. Defenders should prioritize verifying exposure and assessing the feasibility of upgrading to a fixed version.

  • Potential Denial of Service (DoS) via crafted HTTP requests
  • Need to verify exposure in GPAC v26.07.0 deployments
  • Potential need to upgrade to a fixed version

Technical summary

An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. The issue was fixed in commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640. This vulnerability affects GPAC deployments using version 26.07.0. Defenders should prioritize verifying exposure and assessing the feasibility of upgrading to a fixed version.

Defensive priority

Defenders should prioritize verifying exposure in GPAC v26.07.0 deployments and assess the feasibility of upgrading to a fixed version.

Recommended defensive actions

  • Verify GPAC version 26.07.0 deployments for potential exposure
  • Assess the feasibility of upgrading to a fixed version
  • Monitor for crafted HTTP requests in GPAC deployments

Evidence notes

The CVE record and NVD entry provide details on the out-of-bounds read vulnerability in GPAC v26.07.0. However, the corpus does not establish a comprehensive list of affected versions or deployment contexts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-79514 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-79514

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-79514 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-79514

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.