CVE-2026-112061: Out-of-bounds Read in RTMPDump librtmp

The vulnerability in librtmp (RTMPDump) through version 2.6 involves a heap out-of-bounds read in the AMFProp_Decode function. Specifically, the function reads the element count of an AMF0 strict-array type without first confirming that four bytes are available, leading to an out-of-bounds read. An attacker controlling an RTMP server or positioned as a man-in-the-middle can exploit this by sending an AMF0 body ending with a strict-array type byte followed by fewer than four trailing bytes, causing the client to crash.

Successful exploitation results in a client crash due to a heap out-of-bounds read. There is no indication of code execution or data leakage. The vulnerability requires no privileges and no user interaction beyond connecting to a malicious or compromised RTMP server. The CVSS 4.0 base score is 5.3, indicating medium severity.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting to untrusted RTMP servers or use network controls to limit exposure to potentially malicious RTMP traffic.