Live › vulnerability › CVE-2026-112060
Go to dashboardlibrtmp, the RTMP client library shipped with RTMPDump through 2.6, ignores AMF3 decode failures, so oversized string lengths from a malicious RTMP server or man-in-the-middle cause out-of-bounds reads and heap writes. With the token option enabled, DecodeTEA corrupts heap memory and leaks heap bytes to the attacker.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that use librtmp or RTMPDump to pull RTMP streams from servers they do not fully control are exposed, because the attack comes from the server or from someone on the network path. Systems that only handle local files or never connect to RTMP sources are not affected by this flaw. The sources do not say which downstream applications bundle librtmp.
No product ranges from the sources yet.
rtmpdump or librtmp package is installed, for example with rtmpdump --help or ldconfig -p | grep rtmp.2.6 or earlier; the sources say 'through 2.6' and give no fixed version.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes.
This page as .md · .json · in your agent: get_signal("CVE-2026-112060")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.