EUVD-2026-75165
GHSA-mgxg-c8rg-pvvr
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Network-delivered malformed HTTP response requires no auth, but victim must open malicious URL (UI:R); only availability is impacted.
Primary rating from Vendor (mitre).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640.
AnalysisAI
Out-of-bounds read in GPAC's HTTP chunked-transfer downloader (src/utils/downloader.c) crashes the application when processing a server-supplied chunked HTTP response whose declared chunk size exceeds safe bounds. Affected versions include GPAC v26.07.0; the upstream fix introduces a 1 GB chunk-size ceiling and a pre-allocation integer-overflow guard in gf_dm_data_received. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a user to open or stream a media resource from an attacker-controlled HTTP server that returns a chunked transfer-encoding response with a chunk size field exceeding 0x40000000 bytes (1 GB) or a payload size value near GF_UINT_MAX. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) rating correctly frames this as a moderate network-reachable denial-of-service: any operator - from a major streaming platform to a mid-sized municipal IT team in bytom running GPAC-based ingest infrastructure - faces crash risk when users open attacker-controlled media URLs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update GPAC to any build incorporating commit 2fd5a06ab226767900fd86edb5a1e8bfc1010640 (https://github.com/gpac/gpac/commit/2fd5a06ab226767900fd86edb5a1e8bfc1010640), which adds the GF_CHUNK_MAX_SIZE (1 GB) ceiling check and integer-overflow guard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today