This vulnerability arises from a buffer overflow in the RTSP handler of the libalias library. The handler writes outgoing packets into a fixed‑length stack buffer without validating the size, allowing an attacker to overflow the buffer and potentially gain remote control of the system. Depending on the environment, the overflow may target the FreeBSD kernel when ipfw NAT is in use or the natd daemon, both of which typically run with elevated privileges.

The affected product is the FreeBSD operating system when the libalias library is used for RTSP handling. No specific release or version is listed in the advisory, so any FreeBSD installation that incorporates libalias and has ipfw NAT or the natd service enabled could be vulnerable.

Based on the description, it is inferred that the attack vector involves crafted RTSP traffic originating from inside a NAT gateway. Because the flaw can be triggered by such traffic, an internal actor could exploit it without external access. The CVSS score of 8.8 reflects significant impact, and the EPSS score of less than 1% indicates low predicted exploitation likelihood, though the vulnerability is not listed in the CISA KEV catalog. The potential for kernel or root‑level code execution drives a high risk assessment. No public exploit has been released, but the lack of input validation suggests that exploitation could be automated once an attacker can reach the vulnerable host over RTSP.