This vulnerability arises from a buffer overflow in the RTSP handler of the libalias library. The handler writes outgoing packets into a fixed‑length stack buffer without validating the size, allowing an attacker to overflow the buffer and potentially gain remote control of the system. Depending on the environment, the overflow may target the FreeBSD kernel when ipfw NAT is in use or the natd daemon, both of which typically run with elevated privileges.

The affected product is the FreeBSD operating system when the libalias library is used for RTSP handling. No specific release or version is listed in the advisory, so any FreeBSD installation that incorporates libalias and has ipfw NAT or the natd service enabled could be vulnerable.

Because the flaw can be triggered by crafted RTSP traffic sent from within a NAT gateway, an internal network actor may exploit it without needing external network reach. The EPSS score is not available and the vulnerability is not currently catalogued in the CISA KEV list, but the potential for kernel or root‑level code execution gives this issue a high risk assessment. No public exploit is announced, yet the lack of input validation suggests that exploitation could be automated if the attacker can reach the vulnerable host over RTSP.