CVE-2026-112060: Out-of-bounds Write in RTMPDump librtmp

The vulnerability in librtmp through version 2.6 arises because the AMF3_Decode function does not properly handle failures when decoding AMF3 properties. This leads to an out-of-bounds read and a heap out-of-bounds write condition. Specifically, malicious RTMP servers or man-in-the-middle attackers can send AMF3 strings with oversized lengths. When the DecodeTEA token option is enabled, this can corrupt heap memory and leak heap bytes, potentially compromising application stability and confidentiality.

Successful exploitation can cause heap memory corruption and leak sensitive heap data. This can lead to application crashes or partial information disclosure. The CVSS 4.0 score of 6.1 reflects a medium severity with network attack vector, low attack complexity, partial user interaction, and partial impact on confidentiality, integrity, and high impact on availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using untrusted RTMP servers and do not enable the DecodeTEA token option if possible.