CVE-2026-14801: GPAC TeXML Divide-by-Zero Denial of Service Vulnerability

Technical summary

CVE-2026-14801 is a divide-by-zero vulnerability in the txtin_probe_duration function within src/filters/load_text.c of GPAC's TeXML File Handler component. The vulnerability arises from improper handling of the txml_timescale parameter, which can be manipulated to cause integer division by zero. This occurs during the probing phase when GPAC analyzes text file properties. The flaw is classified under CWE-369 (Divide By Zero) and CWE-404 (Uncontrolled Resource Consumption), indicating both the immediate cause and the resource exhaustion pattern it creates. Exploitation requires local system access and a user context with standard privileges.

Business impact

Organizations using GPAC for video processing pipelines or multimedia workflows face localized denial-of-service risk. If GPAC instances are integrated into automated transcoding, media analysis, or content delivery systems, a malicious or corrupted TeXML file could crash worker processes, disrupting batch operations or live stream processing. The impact is contained to availability; confidentiality and integrity are not compromised. For production environments where GPAC runs with elevated privileges or handles untrusted media uploads, this becomes a stability and uptime concern rather than a breach risk.

Affected systems

The vulnerability specifically affects GPAC version 26.03-DEV-rev342-g80071f700-master. No stable release versions are enumerated in the available data. Organizations should verify whether they have deployed this development build or later versions of GPAC that incorporate the TeXML handler in their media processing infrastructure. Verify against official GPAC release notes and vendor advisories to confirm which production or long-term support versions are affected.

Exploitability

Exploitability is limited by the requirement for local access and user-level privileges. An attacker cannot trigger this remotely; they must have an authenticated session on the affected system. The attack surface is narrowed further by dependency on the victim opening or processing a malformed TeXML file. However, in environments where GPAC automatically processes files from untrusted sources (shared folders, uploaded content, email attachments), the barrier is lower. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) correctly reflects low complexity and low privilege threshold, but the local-only access requirement prevents mass exploitation.

Remediation

Apply the patch identified as commit 86a5191f2e750c767253e27ed6cfd6d547afebc2 to your GPAC installation. This patch addresses the txml_timescale division operation to prevent zero-denominator conditions. Verify patch applicability against your exact GPAC version and build configuration. As a temporary mitigating control, restrict file processing permissions and avoid processing TeXML files from untrusted sources until the patch is applied.

Patch guidance

Obtain and apply commit 86a5191f2e750c767253e27ed6cfd6d547afebc2 from the GPAC repository. Users of source-based distributions should rebuild GPAC after applying the patch. Pre-built binary users should check the official GPAC release channels for patched builds incorporating this commit hash. Document the patch date and commit ID in your change management system. Test patched binaries against your media processing workflows before rolling out to production to ensure no regression in text file handling.

Detection guidance

Monitor GPAC process logs and system crash dumps for segmentation faults or arithmetic exception signals (SIGFPE) originating from the load_text filter or txtin_probe_duration function. Deploy file integrity monitoring on TeXML files in your processing pipelines to detect anomalous manipulation. If GPAC runs in containerized environments, track container restarts or process terminations correlated with text file ingestion. Security information and event management (SIEM) systems should flag unexpected crashes in multimedia processing stacks, particularly those handling user-supplied media.

Why prioritize this

Despite the low CVSS score (3.3), this vulnerability warrants prompt but not emergency patching. The local-access-only requirement limits exposure in multi-tenant cloud environments but increases urgency for workstations and dedicated media servers where users routinely process files. Prioritize patching in environments where GPAC processes untrusted or external media, such as user-uploaded video files, streaming archive ingest pipelines, or automated content analysis systems. Organizations with air-gapped or controlled-input GPAC deployments can defer patching with acceptable risk.

Risk score, explained

The CVSS 3.1 score of 3.3 (LOW severity) reflects a denial-of-service impact with no confidentiality or integrity consequence. The Local Attack Vector (AV:L) and Low Complexity (AC:L) indicate straightforward exploitation once system access is gained, but the requirement for Low Privilege (PR:L) and No User Interaction (UI:N) prevents opportunistic remote attacks. Scope is Unchanged (S:U), meaning the impact does not spread to other systems. The score correctly downgrades risk relative to remote code execution flaws, but operational impact in media processing environments may warrant more aggressive patching timelines than the numeric score alone suggests.

Frequently asked questions