CVE-2026-38998CWE-416

CVE-2026-38998

Medium · published September 10, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
37.1
In the wild
Unconfirmed
What it is

A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00439 · 37.1th percentile
Weakness
CWE-416 · Use After Free
Published
2026-09-10T00:17Z
References (3)
http://lists.live555.com/pipermail/live-devel/2026-March/022789.html · [email protected]https://download.live555.com/changelog.txt · [email protected]https://github.com/archersec/security-advisories/blob/master/live555/live555-advisory-2026.md · [email protected]
EPSS history
Timeline
  • 11 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 09 SEP 00:00Z
    A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows…
    cvelistv5