CVE-2026-112061 — librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes r…
Published: 2026-10-18 · CVSS: 5.3 · CVSS 4.0
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7