The flaw resides in the rtsp_parse_method routine of Cijliu's librtsp library. An attacker can supply crafted data that triggers a buffer overflow during method parsing (CWE-119 and CWE-120). The resulting memory corruption may allow the attacker to alter execution flow, potentially enabling arbitrary code execution on the system that hosts the library. The vulnerability is purely local, so it requires the attacker to have local or privileged access to the machine running the vulnerable code.

This issue affects the Cijliu librtsp library (all versions up to the 2ec1a81ad65280568a0c7c16420d7c10fde13b04 commit). No specific version ranges are identified beyond this release. The product is updated via continuous delivery with rolling releases, so new builds may contain the fix, but the vendor has not published a versioned fix or release notes.

The CVSS score of 4.8 reflects moderate impact and local scope. The EPSS score of less than 1% indicates a very low probability of exploitation at present, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Given that the attack vector is local, the practical risk depends on the security posture of the host; those with unrestricted local access or administrative rights are at higher risk. Until a vendor-provided patch or comprehensive workaround is released, the vulnerability remains a moderate concern for systems running the affected library.