PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35203 ZLMediaKit CVE debrief

CVE-2026-35203 is a high-severity vulnerability in the ZLMediaKit streaming media service framework. The VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer, resulting in a heap-buffer-overflow. This vulnerability is fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.

Vendor
ZLMediaKit
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of ZLMediaKit should be aware of this high-severity vulnerability and take immediate action to mitigate the risk. The vulnerability allows for a potential denial-of-service or code execution attack. ZLMediaKit users should update to the patched version as soon as possible.

Technical summary

The VP9 RTP payload parser in ZLMediaKit's ext-codec/VP9Rtp.cpp is vulnerable to a heap-buffer-overflow attack. The parser reads multiple fields from the RTP payload based on flag bits in the first byte without verifying sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer. This vulnerability has been fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.

Defensive priority

High

Recommended defensive actions

  • Update ZLMediaKit to the patched version
  • Implement input validation and sanitization for RTP payloads
  • Monitor for suspicious RTP packet activity
  • Consider implementing compensating controls such as Web Application Firewalls (WAFs)
  • Perform regular vulnerability scans and penetration testing

Evidence notes

The CVE record was published on 2026-04-06T20:16:28.057Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS score of 7.5 and a severity of HIGH.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-06T20:16:28.057Z and has not been modified since then. The NVD entry is currently Analyzed.