PT-2026-30725 · Unknown · Zlmediakit

E1024X · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-35203

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ZLMediaKit (affected versions not specified)

Description The software is a streaming media service framework. The VP9 RTP payload parser in ext-codec/VP9Rtp.cpp improperly handles RTP payloads, specifically failing to verify sufficient data exists in the buffer before reading multiple fields based on flag bits in the first byte. A crafted VP9 RTP packet with a 1-byte payload can trigger a heap-buffer-overflow due to reading past the end of the allocated buffer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2026-35203

Affected Products

Zlmediakit

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35203 · Security Note
• https://github.com/ZLMediaKit/ZLMediaKit/security/advisories/GHSA-gxr3-fwc7-q99h · Note
• https://github.com/ZLMediaKit/ZLMediaKit/commit/435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d · Note
• https://twitter.com/CVEnew/status/2041250708133986725 · Twitter Post