Executive brief
LIVE555 is a widely-used open-source streaming media library that handles RTSP and RTP protocols for video and audio delivery. A use-after-free vulnerability in its TCP socket handler allows attackers to crash the streaming server through specially crafted RTSP and HTTP requests, causing service disruption.
Technical details
The vulnerability is a use-after-free flaw in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp:536). A buffer allocated during RTSPServer::createNewClientConnection is freed in the RTSPClientConnection destructor, but the handler continues to reference the freed memory, leading to a crash. The attack vector is network-based, requiring only the ability to send crafted RTSP and HTTP requests to the streaming server. No authentication or special preconditions are required. An attacker can achieve denial of service by crashing the streaming server. A fix is expected in version 2026.09.23 or later based on the changelog.
Affected products
- LIVE555 Streaming Media 2026.02.26 and earlier
Timeline
- 2026-03-20: disclosed: Vulnerability reported to LIVE555 mailing list
- 2026-09-09: advisory: CVE-2026-38998 published