CVE-2026-112061

MediumCVSS 4.3

Published: 18/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 18/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes.

Risk Assessment

An attacker can remotely crash the RTMP client, potentially enabling a denial-of-service attack. The risk affects applications using librtmp to play RTMP streams.

Recommendation

Upgrade librtmp to a version newer than 2.6 as soon as a fix is available. Until then, connect only to trusted RTMP servers.

Other vulnerabilities in librtmp

CVE-2026-112060Medium
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the DecodeTEA option heap memory is corrupted and heap bytes leak.

Original NVD description (English source)

librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS