Read the docs
TI-2026-27356 Aliases CVE-2026-35203

ZLMediaKit VP9 RTP Parser Out-of-Bounds Read

Priority HIGH 72CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer, resulting in a heap-buffer-overflow. This vulnerability is fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00359 29th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ZLMediaKit (ZLMediaKit): 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZLMediaKitZLMediaKitbefore 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d435dcbcbbf700fd63b2ca9eac6cef3b5ea75169dPatch availableCNA
  • ZLMediaKit VendorZLMediaKit Affected before 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d Fixed in 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zlmediakit:zlmediakit:*:*:*:*:*:*:*:*before 2026-03-29VulnerableZLMediaKit
  • cpe:2.3:a:zlmediakit:zlmediakit:*:*:*:*:*:*:*:* Versions before 2026-03-29 Vulnerable ·ZLMediaKit

Remediation

  • Fix · CNA ZLMediaKit (ZLMediaKit) Fixed in 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-35203

References

Exploit 1

Patch 1

  • TI-2023-15246 ZLMediaKit 4.0 is vulnerable to Directory Traversal. CVSS 3.1HIGH 7.5
  • TI-2022-17354 An attacker can send malicious RTMP requests to make the ZLMediaKit server crash remotely. CVSS 3.1HIGH 7.5
  • TI-2023-20282 Cross Site Scripting vulnerability in ZLMediaKiet v.4.0 and v.5.0 allows an attacker to… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences