CVE-2026-112060

Name of the Vulnerable Software and Affected Versions RTMPDump versions prior to 2.7

Description The librtmp library contains an out-of-bounds read and heap out-of-bounds write issue. This occurs because the AMF3 Decode() function ignores failures during AMF3 property decoding. A malicious RTMP server or a man-in-the-middle attacker can exploit this by sending oversized AMF3 string lengths. When the DecodeTEA token option is used, this can lead to heap memory corruption and the leaking of heap bytes.

Recommendations Update RTMPDump to version 2.7 or later.