Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-14801: GPAC divide-by-zero error in TeXML file handling

CVE-2026-14801 · published 4 months ago

Summary

A specific version of the GPAC multimedia framework can trigger a divide-by-zero error when it processes certain TeXML files, which may cause the program to crash. This condition can be abused by someone who already has access to the system. Update GPAC to the latest release or apply the supplied patch to correct the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Ubuntu:Pro:24.04:LTS	canonical	gpac	All versions
Debian:11	debian	gpac	All versions
–	–	gpac	26.03-DEV-rev342-g80071f700-master
Ubuntu:Pro:14.04:LTS	canonical	gpac	All versions
Ubuntu:Pro:16.04:LTS	canonical	gpac	All versions
Ubuntu:Pro:18.04:LTS	canonical	gpac	All versions
Ubuntu:Pro:20.04:LTS	canonical	gpac	All versions
Ubuntu:Pro:22.04:LTS	canonical	gpac	All versions

Original advisory text

GPAC TeXML File load_text.c txtin_probe_duration divide by zero

A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtin_probe_duration of the file src/filters/load_text.c of the component TeXML File Handler. Such manipulation of the argument txml_timescale leads to divide by zero. An attack has to be approached locally. The name of the patch is 86a5191f2e750c767253e27ed6cfd6d547afebc2. A patch should be applied to remediate this issue.

References

https://github.com/gpac/gpac/ URL
https://ubuntu.com/security/CVE-2026-14801 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-14801 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-14801 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14801... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-14801 Vendor Advisory
https://vuldb.com/cve/CVE-2026-14801 Vendor Advisory
https://vuldb.com/submit/850854 Vendor Advisory
https://vuldb.com/vuln/376395 Vendor Advisory
https://github.com/gpac/gpac/issues/3610 Third Party Advisory
https://vuldb.com/vuln/376395/cti Third Party Advisory
https://github.com/gpac/gpac/commit/86a5191f2e750c767253e27ed6cfd6d547afebc2 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-369Divide By Zero

CWE-404Improper Resource Shutdown or Release

Timeline

Published6 Jul 2026

Updated26 Oct 2026

First seen6 Jul 2026

Sources

CVE-2026-14801 · NVD

CVE-2026-14801 · MITRE

UBUNTU-CVE-2026-14801 · OSV

DEBIAN-CVE-2026-14801 · OSV

CVE-2026-14801 · OSV

Track software like this

Free during beta