The vulnerability is an Improper Restriction of Operations within the Bounds of a Memory Buffer identified in the faad2-2.7/libfaad libraries used by anyRTC-RTMP-OpenSource. The flaw allows a buffer over‑read or overflow when processing certain input files, specifically bits.C or syntax.C. This kind of memory corruption can lead to information disclosure, denial of service, or if exploited correctly, arbitrary code execution, depending on the context in which the overrun occurs.

Affected products are anyRTC-RTMP-OpenSource from anyrtcIO-Community, all releases prior to 1.0. The flaw is located in the third_party/faad2-2.7/libfaad modules that parse media stream files. Users running older versions of the open‑source RTMP server or client components are impacted; newer releases beyond 1.0 have the fix applied.

The CVSS score of 8.7 places this issue in the high‑severity range. The EPSS score of less than 1% indicates low current exploitation probability, and the vulnerability is not yet listed in CISA’s KEV catalog. However, given that the flaw resides in a media decoding library that may be invoked by remote clients, the likely attack vector is remotely provided media streams. Even though exploitation success is uncertain without further details, the combination of high impact and potential remote trigger warrants timely mitigation.