The vulnerability occurs in the rtsp_parse_request function of the cijliu librtsp library, specifically due to a buffer overflow that can be triggered by crafted input. If an attacker can supply malicious data to this function while having local access, the overflow could overwrite adjacent memory, potentially enabling execution of arbitrary code. This represents a classic out‑of‑bounds write flaw (CWE‑119) that, if exploited, compromises the integrity of the affected process. No remote exploits are described; the attack requires local privilege to supply the malicious payload.

The affected product is the cijliu librtsp library with all upstream releases up to the identified commit 2ec1a81ad65280568a0c7c16420d7c10fde13b04. No specific version numbers are provided, as the vendor follows a rolling release model and has not published a fix. All systems running uninterrupted instances of librtsp during the vulnerability window are potentially exposed.

The CVSS base score is 4.8, reflecting a moderate severity when combined with the local attack surface. The EPSS score of less than 1% indicates a very low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not been observed in the wild. Exploitation requires local access, which limits the attack surface but does not eliminate risk, especially in multi‑user environments where privilege escalation is possible. Until an official patch is released, users should consider mitigating local access controls and monitoring for anomalous activity.