{"id":"CVE-2026-112060","kind":"vulnerability","aliases":["CVE-2026-112060"],"related":[],"title":"RTMPDump librtmp: malicious server can corrupt heap memory and leak bytes","description":"librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes.","summary":"librtmp, the RTMP client library shipped with RTMPDump through 2.6, ignores AMF3 decode failures, so oversized string lengths from a malicious RTMP server or man-in-the-middle cause out-of-bounds reads and heap writes. With the token option enabled, DecodeTEA corrupts heap memory and leaks heap bytes to the attacker.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["librtmp","media-tools","package","rtmpdump","self-hosted"],"not_affected_if":["local-files-only","no-rtmp-input"],"how_to_check":"- Check whether the `rtmpdump` or `librtmp` package is installed, for example with `rtmpdump --help` or `ldconfig -p | grep rtmp`.\n- Check whether the installed version is `2.6` or earlier; the sources say 'through 2.6' and give no fixed version.\n- Check whether any application calls librtmp with the token option.","fix":null,"status":"open","published_at":"2026-10-18T13:16:38+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T03:59:34+00:00","updated_at":"2026-10-25T03:59:34+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:59:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"RTMPDump librtmp: malicious server can corrupt heap memory and leak bytes","impact":"medium","summary":"librtmp, the RTMP client library shipped with RTMPDump through 2.6, ignores AMF3 decode failures, so oversized string lengths from a malicious RTMP server or man-in-the-middle cause out-of-bounds reads and heap writes. With the token option enabled, DecodeTEA corrupts heap memory and leaks heap bytes to the attacker.","category":"package","nicknames":[],"who_cares":["rtmpdump","librtmp","media-tools","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"heap memory is corrupted and heap bytes are leaked to a hostile RTMP server","analyst_note":"Find the fixed version and any vendor advisory for RTMPDump or librtmp beyond 2.6; the NVD entry given in the sources does not list one.","how_to_check":"- Check whether the `rtmpdump` or `librtmp` package is installed, for example with `rtmpdump --help` or `ldconfig -p | grep rtmp`.\n- Check whether the installed version is `2.6` or earlier; the sources say 'through 2.6' and give no fixed version.\n- Check whether any application calls librtmp with the token option.","needs_analyst":true,"not_affected_if":["no-rtmp-input","local-files-only"],"who_is_affected":"Teams that use librtmp or RTMPDump to pull RTMP streams from servers they do not fully control are exposed, because the attack comes from the server or from someone on the network path. Systems that only handle local files or never connect to RTMP sources are not affected by this flaw. The sources do not say which downstream applications bundle librtmp.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":3360,"output_tokens":657,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112060':14A,17A '-2026':13A,16A '2.6':36B,85C 'amf3':38B,102C,105C,122C 'attack':80B,118C 'bound':60B,91C,98C 'byte':11A,77B,137C 'caus':56B 'client':30B 'contain':86C 'corrupt':6A,71B,131C 'cve':12A,15A 'decod':39B,103C,107C 'decodetea':70B,130C 'enabl':69B 'failur':40B,108C 'heap':7A,63B,72B,76B,94C,132C,136C 'host':26B 'ignor':37B,104C 'leak':10A,75B,135C 'length':44B,124C 'librari':31B 'librtmp':2A,18B,27B,81C 'malici':3A,47B,109C 'man':52B,114C 'man-in-the-middl':51B,113C 'media':20B 'media-tool':19B 'memori':8A,73B,133C 'middl':55B,117C 'option':68B,129C 'out-of-bound':57B,88C,95C 'overs':42B,121C 'packag':22B 'properti':106C 'read':61B,92C 'rtmp':29B,48B,110C 'rtmpdump':1A,23B,34B,83C 'self':25B 'self-host':24B 'send':120C 'server':4A,49B,111C 'ship':32B 'string':43B,123C 'token':67B,128C 'tool':21B 'vulner':100C 'write':64B,99C","nicknames":[],"mitigations":[],"who_affected":"Teams that use librtmp or RTMPDump to pull RTMP streams from servers they do not fully control are exposed, because the attack comes from the server or from someone on the network path. Systems that only handle local files or never connect to RTMP sources are not affected by this flaw. The sources do not say which downstream applications bundle librtmp.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112060","severity":null,"published_at":"2026-10-18T13:16:38+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}