A heap out-of-bounds read vulnerability exists in librtmp (RTMPDump) through 2.6 in the AMFProp_Decode function. This vulnerability allows a malicious RTMP server or man-in-the-middle to send a specially crafted AMF0 body, potentially crashing the client. The vulnerability is caused by the function not checking for sufficient trailing bytes when decoding an AMF0 strict-array element count. Affected produc [truncated]
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability due to AMF3_Decode ignoring AMF3 property decode failures. This allows malicious RTMP servers or man-in-the-middle attackers to send oversized AMF3 string lengths, potentially corrupting heap memory and leaking heap bytes. The vulnerability can be triggered by sending malicious RTMP traffic, which can [truncated]
