Threat database

A flaw was found in the rgaufman/live555 fork of live555. A remote attacker could exploit a segmentation fault, in the `increaseBufferTo` function. This vulnerability can lead to memory corruption problems and potentially other consequences.

CVE-2025-65407 is a use-after-free vulnerability in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02. An attacker can exploit this by supplying a crafted MPEG Program stream, causing a Denial of Service (DoS) condition. The vulnerability does not impact confidentiality or integrity but can disrupt availability by crashing affected services. Exploitation requires no privileges but does require user interaction to process the malicious stream. No known exploits are currently in the wild, and no patches have been published yet. The CVSS score is 6.5 (medium severity), reflecting the moderate impact and ease of exploitation. European organizations using Live555 for streaming media processing are at risk, especially those in media, broadcasting, and telecommunications sectors.

A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MKV file.

A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS file.

A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS/AAC file.

A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via a crafted MP3 stream.