CVE-2026-38998

EUVD-2026-75138 MEDIUM

Use After Free (CWE-416)

2026-09-09 cve@mitre.org

GHSA-f8rc-m549-vxmc

Denial Of Service Use After Free Memory Corruption

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 10:55 vuln.today

CVSS changed

Sep 14, 2026 - 13:22 NVD

6.5 (MEDIUM)

CVE Published

Sep 09, 2026 - 20:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.

AnalysisAI

A crafted series of RTSP and HTTP requests sent to LIVE555 Streaming Media 2026.02.26 triggers a use-after-free in SocketDescriptor::tcpReadHandler1 (liveMedia/RTPInterface.cpp), crashing the media server and terminating all active streams. The flaw is reachable over the network without credentials, and because LIVE555 is embedded in IP cameras, streaming appliances and media servers, one crash can disrupt many downstream viewers at once. …