CVE-2026-112060

MediumCVSS 6.4

Published: 18/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the DecodeTEA option heap memory is corrupted and heap bytes leak.

Risk Assessment

An attacker can remotely corrupt the RTMP client's heap memory and leak data, potentially leading to a crash or information disclosure. The risk affects applications using librtmp with the DecodeTEA option enabled.

Recommendation

Upgrade librtmp to a version newer than 2.6 as soon as a fix is available. Until then, avoid connecting to untrusted RTMP servers and disable the DecodeTEA option if possible.

Other vulnerabilities in librtmp

CVE-2026-112061Medium
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes.

Original NVD description (English source)

librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS