Use-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the… (CVE-2026-84727)

CVE-2026-84727 is a use-after-free vulnerability in Apache bRPC's RTMP protocol implementation before version 1.18.0. The vulnerability is triggered when processing an RTMP Abort message (protocol control message type 2) that deletes a target RtmpChunkStream object. Concurrent sender threads may still dereference this object without synchronization, leading to use-after-free. This can cause process crashes or memory corruption. Additionally, deleting the chunk stream discards its previous message header, breaking decoding of subsequent compressed chunk headers. The vulnerability affects both RTMP clients and servers using bRPC where the remote peer is untrusted and can send crafted Abort messages targeting active chunk streams.

Exploitation of this vulnerability allows a remote attacker to cause a denial of service by crashing the affected process or potentially corrupt memory, which could lead to undefined behavior or further exploitation. The impact is limited to integrity and availability, with no direct confidentiality impact reported.

A fix is available by upgrading Apache bRPC to version 1.18.0, which addresses this use-after-free issue. Alternatively, applying the patch available at https://github.com/apache/brpc/pull/3515 mitigates the vulnerability. Users should upgrade or patch affected deployments promptly. No other mitigations or workarounds are specified.