CVE-2026-35203

ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer, resulting in a heap-buffer-overflow. This vulnerability is fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ZLMediaKit/ZLMediaKit/commit/435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d	Patch
https://github.com/ZLMediaKit/ZLMediaKit/security/advisories/GHSA-gxr3-fwc7-q99h	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zlmediakit:zlmediakit:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-06 20:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-35203

Mitre link : CVE-2026-35203

CVE.ORG link : CVE-2026-35203

JSON object : View

Products Affected

zlmediakit

zlmediakit

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2026-35203", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35203", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T19:30:37.534657Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ZLMediaKit", "product": "ZLMediaKit", "versions": [{"status": "affected", "version": "< 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d"}]}]}], "published": "2026-04-06T20:16:28.057", "references": [{"url": "https://github.com/ZLMediaKit/ZLMediaKit/commit/435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ZLMediaKit/ZLMediaKit/security/advisories/GHSA-gxr3-fwc7-q99h", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer, resulting in a heap-buffer-overflow. This vulnerability is fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d."}, {"lang": "es", "value": "ZLMediaKit es un framework de servicio de medios de transmisi\u00f3n. El analizador de carga \u00fatil RTP VP9 en ext-codec/VP9Rtp.cpp lee m\u00faltiples campos de la carga \u00fatil RTP bas\u00e1ndose en bits de bandera en el primer byte, sin verificar que existan datos suficientes en el b\u00fafer. Un paquete RTP VP9 manipulado con una carga \u00fatil de 1 byte (0xFF, todos los indicadores activados) hace que el analizador lea m\u00e1s all\u00e1 del final del b\u00fafer asignado, lo que resulta en un desbordamiento de b\u00fafer de pila (heap-buffer-overflow). Esta vulnerabilidad se corrige con el commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zlmediakit:zlmediakit:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6E40C41-1CFE-4C61-9948-9BC843FBF1BC", "versionEndExcluding": "2026-03-29"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}