CVE-2026-38998 in Live555
Summary
by MITRE • 09/09/2026
A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in LIVE555 Streaming Media, specifically within version 2026.02.26, represents a critical memory management flaw located in the SocketDescriptor::tcpReadHandler1 function found in the liveMedia/RTPInterface.cpp source file. This use-after-free condition arises when the application attempts to access or dereference a pointer that has already been freed from memory. In the context of network-facing services like LIVE555, which handles real-time transport protocol streams and RTSP control connections, such errors are particularly dangerous because they can be triggered remotely by an attacker interacting with the streaming server over standard TCP ports. The root cause typically involves a race condition or improper lifecycle management where memory is deallocated while still being referenced by another part of the execution flow, often due to asynchronous event handling mechanisms common in high-performance media servers.
From a technical perspective, this flaw falls under the Common Weakness Enumeration category CWE-416, which defines use-after-free vulnerabilities. When an attacker sends a series of crafted RTSP and HTTP requests, they can manipulate the timing or state transitions within the TCP read handler to force the application into accessing freed memory regions. This access may result in undefined behavior depending on how the operating system manages that specific memory page. In many cases, particularly with modern mitigations like ASLR and DEP enabled, this results in a segmentation fault causing an immediate crash of the server process. However, if the attacker can control the data written to or read from the freed memory before it is reallocated for other purposes, they might achieve arbitrary code execution, although the primary reported impact here is denial of service due to instability and crashes induced by malformed input sequences.
The operational impact of this vulnerability is severe for any organization relying on LIVE555 for media streaming infrastructure. A successful exploitation leads directly to a Denial of Service condition where the streaming server becomes unresponsive or terminates unexpectedly. This disrupts all active streams, affecting end-users who rely on continuous video or audio delivery. For services that require high availability and uptime, such as live broadcasting platforms or surveillance systems using RTSP feeds, this vulnerability poses a significant risk to business continuity. The ability to trigger the crash via crafted HTTP requests also implies that even non-streaming endpoints managed by the same server instance could be destabilized if they share underlying socket handling logic or memory pools within the LIVE555 framework.
To mitigate this risk, immediate patching is required as the vulnerability exists in a specific version of the software. Administrators should upgrade to a patched release where the developers have corrected the memory management logic in SocketDescriptor::tcpReadHandler1. This likely involves ensuring that pointers are nullified after deallocation and adding checks to prevent access to freed objects during asynchronous read operations. Additionally, implementing network-level defenses such as rate limiting on RTSP and HTTP requests can help mitigate the impact of automated exploitation attempts by slowing down the frequency of crafted packets sent to vulnerable instances. Monitoring server logs for frequent crashes or segmentation faults related to RTPInterface components should also be established to detect potential probing activities before a full denial of service occurs.
From an adversarial simulation perspective, this vulnerability aligns with ATT&CK technique T1499 Endpoint Denial of Service, where attackers aim to exhaust resources or crash services rather than compromise confidentiality or integrity directly. The attack vector is classified as Network-based (T1078) if the server is internet-facing, allowing remote exploitation without prior authentication in many default configurations. Security teams should treat this with high priority due to its ease of exploitation via standard web protocols and its direct impact on service availability. Regular vulnerability scanning against known CVEs associated with LIVE555 versions is recommended to ensure that systems are not exposed to this specific memory corruption flaw until the software update is applied across all affected environments.