Quick answers
- Is CVE-2026-84727 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84727 being exploited in the wild.
- How severe is CVE-2026-84727?
- Informational severity, published 21 October 2026.
- Which products and versions are affected?
- Apache Brpc < 1.18.0.
- Is there a fix for CVE-2026-84727?
- Yes: fixed in 1.18.0. Until then: Apply the fix in pull request #3515, which preserves the chunk stream state on abort instead of deleting it, eliminating the use-after-free condition. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-84727 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-84727?
- Check whether you run Apache Brpc at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 1.18.0
Apply the fix in pull request #3515, which preserves the chunk stream state on abort instead of deleting it, eliminating the use-after-free condition.
Technical details
A use-after-free flaw exists in the RTMP protocol handler when processing Abort (type-2) control messages. The code deletes an RtmpChunkStream object upon receiving an Abort, but concurrent send operations on other threads may still be dereferencing that same object during message serialization. An attacker can trigger this race condition by sending an Abort message targeting a chunk stream currently in use for outgoing data, causing the freed object to be accessed and potentially corrupting memory.
Affected products
- Apache bRPC < 1.18.0
Timeline
- 2026-10-21: disclosed
- 2026-09-03: patched: Fix merged in PR #3515