{"id":"CVE-2026-112060","title":"librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode","summary":"librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H","cvssSource":"cna","cwe":["CWE-787"],"vendor":"RTMPDump","product":"librtmp","affected":["librtmp <= 2.6"],"published":"2026-10-18","updated":"2026-10-18","sourceUpdated":"2026-10-18T12:19:50.440Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112060","references":[{"url":"https://hackmd.io/@haindpwn/librtmp-amf3-decode-and-strict-array-oob"},{"url":"https://git.ffmpeg.org/gitweb/rtmpdump.git/blob/138fdb258d9fc26f1843fd1b891180416c9dc575:/librtmp/amf.c"},{"url":"https://rtmpdump.mplayerhq.hu/"},{"url":"https://www.vulncheck.com/advisories/librtmp-rtmpdump-through-2.6-heap-out-of-bounds-write-via-amf3-decode","label":"VulnCheck Advisory: librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode"}],"tags":["cve.org"],"ingestedAt":"2026-10-18T12:41:54.058Z","slug":"CVE-2026-112060","body":"## Overview\n\nlibrtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, and with the token option DecodeTEA corrupts heap memory and leaks heap bytes.\n\n## Affected\n\n- `librtmp <= 2.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}