CVE-2026-112061: librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFPropDecode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client.
Affected Software
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
Clients using affected librtmp versions are exposed when they connect to an untrusted or attacker-controlled RTMP server. A network attacker able to modify the RTMP traffic can also trigger it through a man-in-the-middle position.
What does an attacker need to send to trigger the crash?
The attacker needs to provide an AMF0 body that ends with a strict-array type byte followed by fewer than four remaining bytes. This causes AMFProp_Decode to read the strict-array element count beyond the heap buffer boundary.
Is user interaction required?
Yes. The affected client must connect to or otherwise process RTMP traffic from the malicious server; the severity vector identifies user interaction as required.
What is the known impact?
The described impact is a client crash, resulting in denial of service. The supplied severity vector indicates no confidentiality or integrity impact.