# CVE-2026-35203: ZLMediaKit heap-buffer-overflow in VP9 RTP payload parser

Source: https://junglewise.ai/threats/cve-2026-35203-zlmediakit-heap-buffer-overflow-in-vp9-rtp-payload-parser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-06. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-35203 · Severity: high · CVSS 7.5 · Published 2026-04-06

ZLMediaKit is an open-source framework used for high-performance streaming of media like video and audio. A security flaw in how it handles specific video data (VP9) allows an attacker to send a specially crafted network packet that causes the system to read memory incorrectly. This can lead to immediate service crashes, resulting in a denial of service for all connected users.

Technologies: [Zlmediakit](https://junglewise.ai/threats/technologies/zlmediakit). Vendors: [Zlmediakit](https://junglewise.ai/threats/vendors/zlmediakit).

## Quick answers

**Is CVE-2026-35203 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35203 being exploited in the wild.

**How severe is CVE-2026-35203?** High severity, with a CVSS score of 7.5, published 6 April 2026.

**Which products and versions are affected?** Zlmediakit versions up to (excluding) commit 435dcbc.

**Is there a fix for CVE-2026-35203?** A patch was published on 2026-03-29: Fix commit 435dcbc merged into master Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35203 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-35203?** Check whether you run Zlmediakit at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read (CWE-125) exists in the VP9 RTP payload parser within `ext-codec/VP9Rtp.cpp`. The `RTPPayloadVP9::parse` function processes flag bits from the first byte of a payload to determine which optional fields (such as PictureID or Layer Indices) are present. However, it fails to validate the `dataLength` before incrementing the data pointer and dereferencing it. A remote, unauthenticated attacker can send a 1-byte RTP packet with all flag bits set (0xFF), forcing the parser to read multiple bytes past the end of the allocated heap buffer. This can result in a denial of service (segmentation fault) or potential information disclosure if the out-of-bounds data is incorporated into forwarded media frames. The issue is resolved in commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.

## Affected products

- ZLMediaKit ZLMediaKit versions up to (excluding) commit 435dcbc

## Timeline

- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: CVE-2026-35203 published
- 2026-03-29: patched: Fix commit 435dcbc merged into master

## References

- [https://github.com/ZLMediaKit/ZLMediaKit/commit/435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d](https://github.com/ZLMediaKit/ZLMediaKit/commit/435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d)
- [https://github.com/ZLMediaKit/ZLMediaKit/security/advisories/GHSA-gxr3-fwc7-q99h](https://github.com/ZLMediaKit/ZLMediaKit/security/advisories/GHSA-gxr3-fwc7-q99h)

## Related threats

- [ZLMediaKit HTTP API command injection in setServerConfig](https://junglewise.ai/threats/cve-2026-67827-incorrect-access-control-in-the-http-api-module-in-zlmediakit)
- [ZLMediaKit downloadFile API directory traversal via prefix comparison](https://junglewise.ai/threats/cve-2026-81028-zlmediakit-downloadfile-api-directory-traversal-via-prefix)