PT-2025-48494 · Unknown · Live555 Streaming Media

Heng Zhang · Published 2025-12-01 · Updated 2025-12-23 · CVE-2025-65408

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Live555 Streaming Media version 2018.09.02

Description A flaw exists in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function that can lead to a Denial of Service (DoS). This occurs when processing a specially crafted ADTS file. Sending a crafted AAC/ADTS request to Live555 Streaming Media RTSP servers can cause them to crash remotely without requiring authentication.

Recommendations Restrict untrusted network traffic to the server. Disable the AAC demo stream. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-65408

Affected Products

Live555 Streaming Media

References · 11

• 🔥 https://shimo.im/docs/VMAPLVLp57SJ92Ag · Exploit
• https://osv.dev/vulnerability/CVE-2025-65408 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-65408 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-65408 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-65408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-65408 · Security Note
• https://github.com/rgaufman/live555 · Note
• https://twitter.com/VolerionSec/status/1995542678096736418 · Twitter Post
• https://twitter.com/CVEnew/status/1995543101041967557 · Twitter Post
• https://t.me/cveNotify/146656 · Telegram Post
• https://t.me/CVEtracker/38562 · Telegram Post