CVE-2026-38998

Published Sep 9, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.

Analysis

Technical impact

This is a classic use‑after‑free bug (CWE-416) located in the SocketDescriptor::tcpReadHandler1 function of LIVE555 Streaming Media, specifically in RTPInterface.cpp. When an attacker sends a carefully crafted sequence of RTSP and HTTP requests, the server can be forced to consume invalid memory and crash. The result is a loss of service on the affected server.

Affected Systems

The vulnerability is present in LIVE555 Streaming Media version 2026.02.26. No other vendors or product families are listed.

Risk and Exploitability

The issue can be triggered remotely over the network through standard RTSP and HTTP traffic, resulting in a denial of service. The CVSS score is 6.5 and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog, and the low exploitation probability implies that active attacks are unlikely but a vulnerable server accepting external requests remains at risk until a patch or mitigation is applied.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

No data.

Vendor Product Versions

Live555

Streaming Media

Version	Status	Scheme	Platform
`2026.02.26`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a recent release of LIVE555 that contains the fix for the use‑after‑free bug.
If an immediate upgrade is not possible, configure network perimeter defenses to block or rate‑limit malformed RTSP and HTTP requests that target the offending endpoints.
Monitor the application for repeated crashes or abnormal usage patterns and restart or isolate the service when instability is observed.

Generated by OpenCVE AI on September 21, 2026 at 05:44 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.439% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
http://lists.live555.com/pipermail/live-devel/2026-March/022789.html
https://download.live555.com/changelog.txt
https://github.com/archersec/security-advisories/blob/master/live555/live555-advisory-2026.md

History

Sep 21, 2026 6:00 AM Title updated View changes

Type	Values Removed	Values Added
Title	Use-After-Free in LIVE555 Streaming Media Enables Remote Denial of Service

Sep 14, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 11, 2026 3:15 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Live555 Live555 streaming Media
Vendors & Products		Live555 Live555 streaming Media

Sep 9, 2026 11:15 PM Title updated. Weaknesses updated View changes

Type	Values Removed	Values Added
Title		Use-After-Free in LIVE555 Streaming Media Enables Remote Denial of Service
Weaknesses		CWE-416

Sep 9, 2026 7:30 PM Description updated. Added references View changes

Type	Values Removed	Values Added
Description		A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.
References		http://lists.live555.com/pipermail/live-devel/2026-March/022789.html https://download.live555.com/changelog.txt https://github.com/archersec/security-advisories/blob/master/live555/live555-advisory-2026.md