CVE-2026-35203: ZLMediaKit VP9 RTP Parser Out-of-Bounds Read
ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer, resulting in a heap-buffer-overflow. This vulnerability is fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ZLMediaKit VP9 RTP Parser (ext-codec/VP9Rtp.cpp)to a version that resolves this vulnerability.Patch 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35203?
CVE-2026-35203 is classified as a high severity vulnerability due to the potential for out-of-bounds read issues.
How do I fix CVE-2026-35203?
To mitigate CVE-2026-35203, update ZLMediaKit to a version released after March 29, 2026, which includes the necessary patch.
What kind of vulnerability is CVE-2026-35203?
CVE-2026-35203 is an out-of-bounds read vulnerability in the VP9 RTP parser of ZLMediaKit.
Which versions of ZLMediaKit are affected by CVE-2026-35203?
All versions of ZLMediaKit prior to the patch released on March 29, 2026, are affected by CVE-2026-35203.
What impact does CVE-2026-35203 have on ZLMediaKit users?
CVE-2026-35203 could lead to potential crashes or memory leaks for users of ZLMediaKit if exploited.