Executive brief
LIVE555 is a widely used open-source library for streaming multimedia over the internet. A security flaw in how it handles streaming sessions allows an attacker to hijack or disrupt active video or audio streams if they can obtain a valid session ID. This can result in the streaming server crashing or legitimate users being disconnected from their media feeds.
Technical details
An authorization bypass exists in the RTSP session management of LIVE555. The root cause is that within-session commands such as PLAY, PAUSE, and TEARDOWN were accepted based solely on a valid Session token without verifying the authentication status of the underlying TCP connection. An attacker who obtains a valid session identifier can initiate a second, unauthenticated TCP connection and replay the token. This causes a 'misbinding' of stream callback ownership; when the attacker's connection is closed, the server attempts to execute a callback using a stale pointer to the closed connection object, leading to a use-after-free style crash (SIGSEGV). The vulnerability was addressed in version 2026.04.22 by adding mandatory authentication checks to within-session command handlers.
Affected products
- Live Networks LIVE555 Streaming Media before 2026.04.22
Timeline
- 2026-04-22: patched: Version 2026.04.22 released to address the flaw.
- 2026-05-19: advisory: CVE-2026-41470 published.