CVE-2026-112061 RTMPDump CVE debrief

Who should care

Defenders responsible for RTMP client implementations, network administrators, and security teams should assess exposure and prioritize verification of client-side error handling and bounds checking.

Why it matters

CVE-2026-112061 is a medium-severity vulnerability in librtmp (RTMPDump) that can lead to client crashes and potential data integrity issues. Defenders should assess exposure, verify client-side error handling, and monitor RTMP traffic for suspicious activity.

• Potential client crashes due to out-of-bounds reads
• Need for verification of client-side error handling and bounds checking
• Possible data integrity issues if not properly mitigated
• Requires review of RTMP traffic for suspicious activity

Technical summary

The AMFProp_Decode function in librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability. A malicious RTMP server or man-in-the-middle can send an AMF0 body ending with a strict-array type byte and fewer than four trailing bytes to crash the client. The vulnerability is due to insufficient checks on the number of trailing bytes when decoding AMF0 strict-array elements. Defenders should assess exposure, verify client-side error handling, and monitor RTMP traffic for suspicious activity to mitigate potential impacts.

Defensive priority

Medium

Recommended defensive actions

• Review and assess exposure to RTMP servers or man-in-the-middle attacks
• Verify client-side implementations for proper error handling and bounds checking
• Consider applying patches or updates when available
• Monitor for suspicious RTMP traffic
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.