The vulnerability is a use‑after‑free in the RTMP implementation of Apache bRPC. A malicious RTMP peer can send a crafted Abort control message that deletes a chunk stream object while the same object is still being referenced by concurrent sender threads. This results in the target stream being freed while still in use, potentially causing the process to crash or corrupt memory. The flaw also discards the previous message header on the stream, so subsequent compressed chunk headers cannot be decoded correctly, amplifying the impact on data integrity.

All installations of Apache bRPC older than 1.18.0 that use the RTMP policy are affected, regardless of platform. Both server‑side and client‑side applications that exchange RTMP streams with untrusted peers are vulnerable. The flaw exists only when an external endpoint can send Abort messages, so any application exposing an RTMP interface to the network is implicated.

The CVSS score of 5.4 indicates a moderate severity. No EPSS value is available, and the issue is not listed in the CISA KEV catalog. The weakness can be exploited remotely by any untrusted RTMP client that can craft an Abort message targeting a stream currently in use by the server or client. Exploitation could lead to denial of service or, if an attacker can manipulate the freed memory, potential memory corruption. The lack of a listed KEV and the moderate CVSS suggest that while the immediate threat is limited, a determined attacker may still find a way to leverage it for more serious damage.