CVE-2026-112061 in librtmp
Summary
by MITRE • 10/18/2026
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified within librtmp, specifically versions through 2.6, represents a critical heap-based out-of-bounds read flaw located in the AMFProp_Decode function. This component is responsible for parsing Action Message Format (AMF) data, which serves as the primary serialization format for communication between Adobe Flash applications and RTMP servers. The core technical deficiency lies in the validation logic governing strict-array elements during decoding. Specifically, when processing an AMF0 type byte indicating a strict array, the implementation attempts to read the element count from the subsequent bytes without first verifying that sufficient data remains in the buffer. This lack of bounds checking allows for a scenario where a malicious actor can craft an RTMP packet containing an AMF0 body that terminates with a strict-array identifier followed by fewer than four trailing bytes. Upon encountering this malformed input, the decoder proceeds to read memory locations beyond the allocated heap boundary, leading to undefined behavior and typically resulting in application crashes or segmentation faults.
From an operational perspective, this vulnerability poses a significant risk to clients utilizing librtmp for streaming media consumption or interaction with RTMP endpoints. Since the attack vector involves receiving data from a server, it can be exploited by malicious RTMP servers that intentionally send crafted payloads designed to trigger the out-of-bounds read. Furthermore, because the flaw relies on network input, it is also susceptible to exploitation via man-in-the-middle attacks where an adversary intercepts and modifies traffic between a legitimate client and server. The immediate impact of successful exploitation includes denial of service through application termination, which disrupts media playback services. In more complex scenarios involving specific memory layouts or subsequent operations on corrupted data structures, this vulnerability could potentially lead to information disclosure by leaking heap contents or serve as a precursor for arbitrary code execution if the out-of-bounds read allows an attacker to gain insight into memory addresses and control flow mechanisms.
This flaw aligns with Common Weakness Enumeration (CWE) category CWE-125, which describes Out-of-Bounds Read vulnerabilities where software reads data past the end or before the beginning of the intended buffer. The exploitation technique is consistent with ATT&CK tactic T1499, Endpoint Denial of Service, as it aims to disrupt service availability by crashing the client application. To mitigate this risk, organizations relying on librtmp should prioritize upgrading to patched versions that implement proper bounds checking before accessing array element counts. Developers integrating RTMP functionality must ensure that all AMF data is validated against buffer limits prior to parsing operations. Additionally, implementing network-level filtering or intrusion detection systems capable of identifying anomalous RTMP packet structures can provide an additional layer of defense against exploitation attempts targeting this specific heap corruption flaw.