EUVD-2026-41814
GHSA-7xpm-q9mm-p5qh
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring low-privilege file submission to trigger a process crash; no confidentiality or integrity impact applies.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtin_probe_duration of the file src/filters/load_text.c of the component TeXML File Handler. Such manipulation of the argument txml_timescale leads to divide by zero. An attack has to be approached locally. The name of the patch is 86a5191f2e750c767253e27ed6cfd6d547afebc2. A patch should be applied to remediate this issue.
AnalysisAI
Divide-by-zero in GPAC's TeXML file handler crashes the process when a crafted file carries a zero or invalid txml_timescale value, triggering an unhandled arithmetic exception in txtin_probe_duration. The affected version is the development snapshot 26.03-DEV-rev342-g80071f700-master; exploitation is constrained to local users able to supply malicious input files, with impact limited to a process-level denial of service. No active exploitation or public proof-of-concept has been identified; an upstream fix commit is available on GitHub but no patched stable release has been independently confirmed.
Technical ContextAI
GPAC is an open-source multimedia framework implementing ISO/IEC standards for media file packaging, streaming, and playback. The vulnerable function txtin_probe_duration resides in src/filters/load_text.c, which is part of the TeXML (Timed Text Markup Language) file handler used to probe media duration from timed-text input. CWE-369 (Divide by Zero) is the root cause: when txml_timescale is zero or otherwise crafted to produce a zero denominator, the arithmetic division inside the probing logic raises an unhandled exception, crashing the GPAC process. The CPE cpe:2.3:a:n/a:gpac:*:*:*:*:*:*:*:* uses 'n/a' as the vendor identifier, consistent with an open-source project without a formal NVD vendor assignment; the wildcard version field means no bounded version range is officially specified in the CPE data alone.
RemediationAI
The upstream fix is available as commit 86a5191f2e750c767253e27ed6cfd6d547afebc2 in the GPAC GitHub repository at https://github.com/gpac/gpac/commit/86a5191f2e750c767253e27ed6cfd6d547afebc2. Users building GPAC from source should update to any revision at or after this commit. No patched stable release version is independently confirmed from the available data - the fix is currently a source-level patch only. As a compensating control for deployments that cannot immediately rebuild from source, restrict GPAC processing to trusted, internally-generated TeXML files and block ingestion of externally-sourced timed-text input; this eliminates the attack surface without altering any service configuration, though it will prevent legitimate processing of untrusted media until the fix is applied.
Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitra
NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.8), this vulnera
GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free vulnerability in function gf_isom_dovi_config_get. Rated crit
Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Rated critical severity (CVSS 9.8), this vulnerabilit
NULL Pointer Dereference in the "isomedia/track.c" module's "MergeTrack()" function of GPAC v0.5.2 allows attackers to e
An issue was discovered in libgpac.a in GPAC 0.8.0, as demonstrated by MP4Box. Rated critical severity (CVSS 9.8), this
An issue was discovered in MP4Box in GPAC 0.7.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2. Rated critical severity (CVSS 9.1), this vulnerability
A vulnerability, which was classified as critical, has been found in GPAC 2.3-DEV-rev40-g3602a5ded.c. Rated high severit
A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Rated high sev
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
An exploitable integer overflow vulnerability exists within the MPEG-4 decoding functionality of the GPAC Project on Adv
Same weakness CWE-369 – Divide By Zero
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today