The vulnerability in librtmp occurs because AMF3_Decode ignores failures when decoding AMF3 strings, allowing attackers to send oversized string lengths that cause an out‑of‑bounds read and subsequent heap out‑of‑bounds write. When the token option DecodeTEA is enabled, the corrupted heap may leak memory contents; this heap corruption can lead to application crashes or provide an opportunity for arbitrary code execution. The weakness is classified as CWE-787.

The vulnerability affects the RTMPDump project’s librtmp component, specifically any releases through version 2.6. Earlier releases are also potentially affected due to the same code path, but no later version has been confirmed to fix the issue in the supplied data.

The CVSS score of 6.1 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA's KEV catalog. Based on the description, the likely attack vector involves a remote attacker who can control or intercept an RTMP stream—such as a malicious RTMP server or a man‑in‑the‑middle attacker—by sending specially crafted AMF3 payloads. Successful exploitation would corrupt the application's heap, potentially crashing the process or allowing execution of injected code, though the exact impact depends on the context of the target system.