PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35203 ZLMediaKit CVE debrief

CVE-2026-35203 is a high-severity vulnerability in the ZLMediaKit streaming media service framework. The VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer, resulting in a heap-buffer-overflow. This vulnerability is fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.

Vendor
ZLMediaKit
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of ZLMediaKit should be aware of this high-severity vulnerability and take immediate action to mitigate the risk. The vulnerability allows for a potential denial-of-service or code execution attack. ZLMediaKit users should update to the patched version as soon as possible.

Technical summary

The VP9 RTP payload parser in ZLMediaKit's ext-codec/VP9Rtp.cpp is vulnerable to a heap-buffer-overflow attack. The parser reads multiple fields from the RTP payload based on flag bits in the first byte without verifying sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer. This vulnerability has been fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.

Defensive priority

High

Recommended defensive actions

  • Update ZLMediaKit to the patched version
  • Implement input validation and sanitization for RTP payloads
  • Monitor for suspicious RTP packet activity
  • Consider implementing compensating controls such as Web Application Firewalls (WAFs)
  • Perform regular vulnerability scans and penetration testing

Evidence notes

The CVE record was published on 2026-04-06T20:16:28.057Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The vulnerability has a CVSS score of 7.5 and a severity of HIGH.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35203 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35203

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35203 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35203

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.