CVE-2026-112060: librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
A malicious RTMP server can exploit it against a client that connects to it. A man-in-the-middle attacker may also exploit it by modifying RTMP traffic in transit.
What conditions are required for exploitation?
The attacker must cause the target to process malicious AMF3 data containing oversized string lengths. The described heap corruption and heap-byte disclosure occur with the DecodeTEA token option.
What is the impact if exploitation succeeds?
Successful exploitation can corrupt heap memory, leak heap bytes, and cause a denial of service. The stated severity vector also indicates potential low-impact confidentiality and integrity effects.