CVE-2026-49420 — Buffer overflow in libalias RTSP handler
The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit b…
Published: 2026-08-19 · CVSS: 8.8 · CVSS 3.1
The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a stack buffer, potentially achieving remote code execution in the kernel (when using ipfw(4) NAT) or in the natd(8) process (which generally runs as the root user).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7