CVE-2026-112060 Details
Description
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes.
A heap out-of-bounds write vulnerability has been identified in the librtmp library of RTMPDump, affecting versions through 2.6. This vulnerability arises from the AMF3 decoding process, which fails to properly validate string lengths received from RTMP servers. Malicious servers or man-in-the-middle attackers can exploit this by sending oversized lengths, leading to memory corruption. When the 'token' option is used, this exploitation allows for a significant heap memory overwrite, creating a potential avenue for further attacks.
Users are advised to update to the latest version of RTMPDump, where this vulnerability has been addressed. The official GitHub repository contains the patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 18, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.ffmpeg.org/gitweb/rtmpdump.git/blob/138fdb258d9fc26f1843fd1b891180416c9dc575:/librtmp/amf.c | [email protected] | Source CodeVendor |
| https://hackmd.io/@haindpwn/librtmp-amf3-decode-and-strict-array-oob | [email protected] | BundleExploitTechnical Analysis |
| https://rtmpdump.mplayerhq.hu/ | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/librtmp-rtmpdump-through-2.6-heap-out-of-bounds-write-via-amf3-decode | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| librtmp | <= 2.6 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 18, 2026 | New CVE Received | [email protected] |