{"id":"CVE-2026-112061","kind":"vulnerability","aliases":["CVE-2026-112061"],"related":[],"title":"librtmp: malicious RTMP server can crash clients via heap over-read","description":"librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client.","summary":"librtmp (RTMPDump) through 2.6 reads an AMF0 strict-array element count in AMFProp_Decode before checking that four bytes remain, a heap out-of-bounds read. A malicious RTMP server or man-in-the-middle can send a crafted AMF0 body to crash the client.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c","librtmp","media-streaming","package","rtmpdump"],"not_affected_if":["no-rtmp-client-use","trusted-servers-only"],"how_to_check":"- Check whether the application links against librtmp: `ldd` on the binary or `pkg-config --modversion librtmp` on the build host\n- Look for a librtmp version of 2.6 or earlier in the installed packages (unknown fixed version in sources)","fix":"- Upgrade librtmp past 2.6 once a fixed release is available (fixed version unknown in sources)\n- Until then, only connect to trusted RTMP servers over protected networks","status":"open","published_at":"2026-10-18T13:16:38+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T04:26:45+00:00","updated_at":"2026-10-25T04:26:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:26:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade librtmp past 2.6 once a fixed release is available (fixed version unknown in sources)\n- Until then, only connect to trusted RTMP servers over protected networks","reach":"network","title":"librtmp: malicious RTMP server can crash clients via heap over-read","impact":"low","summary":"librtmp (RTMPDump) through 2.6 reads an AMF0 strict-array element count in AMFProp_Decode before checking that four bytes remain, a heap out-of-bounds read. A malicious RTMP server or man-in-the-middle can send a crafted AMF0 body to crash the client.","category":"package","nicknames":[],"who_cares":["librtmp","rtmpdump","media-streaming","c"],"confidence":0.6,"needs_auth":"no","worst_case":"client process crashes on malicious RTMP server response","analyst_note":"Confirm the fixed version and whether downstream packages ship librtmp; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112061 for fix details.","how_to_check":"- Check whether the application links against librtmp: `ldd` on the binary or `pkg-config --modversion librtmp` on the build host\n- Look for a librtmp version of 2.6 or earlier in the installed packages (unknown fixed version in sources)","needs_analyst":true,"not_affected_if":["no-rtmp-client-use","trusted-servers-only"],"who_is_affected":"Applications that use librtmp (RTMPDump) to connect to RTMP servers, especially ones that accept untrusted or attacker-reachable RTMP streams. Systems that never open RTMP connections to outside servers are unlikely to be exposed. The sources do not say whether any specific distribution or downstream product is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000662,"input_tokens":3360,"output_tokens":652,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112061':15A,18A '-2026':14A,17A '2.6':29B,77C 'amf0':32B,68B,93C,117C 'amfprop':39B,88C 'array':35B,96C,124C 'bodi':69B,118C 'bound':52B,84C 'byte':45B,103C,126C,132C 'c':19B 'check':42B,100C 'client':7A,73B,136C 'contain':78C 'count':37B,98C 'craft':67B 'crash':6A,71B,134C 'cve':13A,16A 'decod':40B,89C 'element':36B,97C 'end':119C 'fewer':128C 'four':44B,102C,130C 'heap':9A,48B,80C 'librtmp':1A,20B,26B,74C 'malici':2A,55B,106C 'man':60B,110C 'man-in-the-middl':59B 'media':22B 'media-stream':21B 'middl':63B,113C 'out-of-bound':49B,81C 'over-read':10A 'packag':24B 'read':12A,30B,53B,85C,91C 'remain':46B,104C 'rtmp':3A,56B,107C 'rtmpdump':25B,27B,75C 'send':65B,115C 'server':4A,57B,108C 'stream':23B 'strict':34B,95C,123C 'strict-array':33B,94C,122C 'trail':131C 'type':125C 'via':8A 'vulner':86C","nicknames":[],"mitigations":[],"who_affected":"Applications that use librtmp (RTMPDump) to connect to RTMP servers, especially ones that accept untrusted or attacker-reachable RTMP streams. Systems that never open RTMP connections to outside servers are unlikely to be exposed. The sources do not say whether any specific distribution or downstream product is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T13:16:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112061","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112061","severity":null,"published_at":"2026-10-18T13:16:38+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}