A flaw in the rgaufman/live555—an open‑source fork of the Live555 media streaming library—allows a remote attacker to trigger a segmentation fault in the increaseBufferTo function. The resulting memory corruption may enable arbitrary code execution or other unintended behavior. The weakness is classified as CWE‑824 and presents moderate risk, with a CVSS score of 6.3 that reflects potential impacts on confidentiality, integrity, and availability if fully exploited.

The affected product is the rgaufman/live555 fork of Live555. No specific version identifiers are provided in the CNA data, so any installation of this repository that has not been updated to a fixed version is potentially vulnerable.

With a CVSS score of 6.3 and an EPSS value of less than 1 %, the likelihood of exploitation is low, and it is not currently documented in CISA’s KEV catalog. However, the vulnerability can be triggered by remote input that reaches the damaged code path, so a network‑based attacker could send crafted packets to the media server component. No official patch or workaround is available, and the CNA indicates that mitigations do not meet Red Hat’s deployment criteria. The only realistic defence currently is to prevent the vulnerable code from receiving untrusted data or to apply a vendor‑generated patch once it becomes available.