A heap out‑of‑bounds read occurs in librtmp’s AMFProp_Decode when it processes an AMF0 strict‑array type. The function reads an array element count before verifying that four bytes are available, allowing a malicious RTMP server or man‑in‑the‑middle to send a truncated AMF0 body that causes a client crash. The bug cannot lead to arbitrary code execution, but it can disrupt service availability for any application using the affected librtmp library.

The vulnerability affects RTMPDump’s librtmp component through version 2.6. Any client built with librtmp 2.6 or earlier and that processes AMF0 payloads from an external RTMP server is susceptible. No other products or higher versions are mentioned.

The CVSS base score of 5.3 indicates moderate severity, and no EPSS data is available. The vulnerability is not currently listed in CISA’s KEV catalog. The attack vector is remote; an attacker only needs to control or intercept the RTMP stream and send a malformed strict‑array payload. Because the flaw causes a crash rather than privilege escalation, the risk is primarily denial of service, yet it remains exploitable without any special privileges or authentication.