A VP9 RTP payload parser in ZLMediaKit reads fields based on flag bits without verifying the payload length. A crafted packet with a single byte payload and all flags set causes the parser to read past the allocated buffer, creating a heap‑buffer-overflow. While the description states only a memory corruption, such an overflow can lead to crashes or, if an attacker can influence subsequent heap usage, potential remote code execution. The weakness is identified as CWE‑125.

All versions of ZLMediaKit that include the ext‑codec/VP9Rtp.cpp component before the patch commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d are affected, regardless of the deployment environment. The vulnerability applies to any build that processes VP9 RTP streams. No explicit version numbers are listed, so any release before the fix should be considered vulnerable.

The CVSS score of 7.5 indicates moderate‑to‑high severity. Attackers can deliver a malicious VP9 RTP packet over the network to trigger the overflow, as the flaw relies on network‑exposed parsing logic. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The description suggests that exploitation is possible through crafted network traffic, though no public exploits are currently reported.