Heap Buffer Overflow in ZLMediaKit Streaming Framework

CVE-2026-35203

What is CVE-2026-35203?

A vulnerability exists in the VP9 RTP payload parser of ZLMediaKit, where it mishandles data reading operations. The parser reads fields based solely on flag bits in the first byte, failing to check if enough data is present in the buffer. This flaw can be exploited by sending a specially crafted VP9 RTP packet with a minimal payload. Such an attack could cause the parser to read beyond the allocated buffer, leading to a potential heap buffer overflow and subsequent denial of service or arbitrary code execution risks. The issue has been addressed in recent updates.

References