# CVE-2026-102716: NetX RTSP server packet pool exhaustion in Session header parsing

Source: https://junglewise.ai/threats/cve-2026-102716-an-unauthenticated-client-can-drain-the-rtsp-server-s-packet  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-29. Updated: 2026-09-29  
License: CC BY 4.0 with a link back

CVE-2026-102716 · Severity: info · Published 2026-09-29

A network-accessible RTSP server in NetX can be forced to become unresponsive by an unauthenticated attacker sending malformed requests with invalid Session headers. The server fails to properly release memory buffers when processing these requests, causing the packet pool to be depleted within 26 requests. Once the pool is exhausted, the server stops accepting new connections and may affect other applications sharing the same memory pool.

Technologies: [Microsoft NetX](https://junglewise.ai/threats/technologies/netx). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-102716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102716 being exploited in the wild.

**How severe is CVE-2026-102716?** Informational severity, published 29 September 2026.

**Which products and versions are affected?** Microsoft NetX affected versions unspecified.

**Is there a fix for CVE-2026-102716?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102716 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102716?** Check whether you run Microsoft NetX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An RTSP parser in NetX returns a raw NetX error code instead of an RTSP status code when the Session header cannot be parsed, causing the error handler to take an unrecognized code path that fails to release an already-allocated response packet. The vulnerability allows unauthenticated network clients to trigger this condition repeatedly, exhausting the shared packet pool and causing denial of service to the RTSP server and potentially other components using the same memory allocator.

## Affected products

- Microsoft NetX affected versions unspecified

## Timeline

- 2026-09-29: disclosed

## Related threats

- [NetX DHCP client buffer over-read in option parsing](https://junglewise.ai/threats/cve-2026-102720-a-dhcp-server-or-anyone-on-the-lan-who-answers-a-discover-first)
- [NetX ICMPv6 option parsing buffer over-read and denial of service](https://junglewise.ai/threats/cve-2026-102714-nx-icmpv6-validate-options-scans-the-option-area-with-while)
- [NetX TFTP server heap buffer overflow in DATA handler](https://junglewise.ai/threats/cve-2026-102713-the-tftp-server-accepts-a-data-datagram-of-any-size-the)