mediasoup EUVD-2026-65694

Exploitation requires the attacker to hold an active on-path (network man-in-the-middle) position enabling interception and injection of UDP packets between the victim and the mediasoup worker. The target transport must be a PlainTransport or PipeTransport with SCTP enabled (sctpParameters configured in the transport options) and without SRTP/DTLS protection - specifically, PlainTransport where srtpCryptoSuite is not configured or SRTP is explicitly disabled. WebRtcTransport is explicitly not vulnerable because its SCTP stack operates inside DTLS, which provides the cryptographic integrity that the SCTP layer lacks. PipeTransport is used for internal SFU federation and is typically not internet-exposed, reducing risk for that path. No API-level authentication or credentials against the mediasoup application are required. Exploitation is limited to the SCTP handshake window and requires the ability to inject crafted SCTP packets at the network layer.

The NVD CVSS 3.1 score of 5.6 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) is an accurate representation of this vulnerability's real-world priority. AC:H correctly captures the on-path network position requirement - passive observers cannot exploit this flaw. No EPSS data is available in the provided intelligence. KEV status is negative, meaning no confirmed active exploitation by CISA. No POC code has been publicly identified at time of analysis. The moderate C:L/I:L/A:L triple reflects that a successful attacker gains DataChannel message injection capability as a trusted peer, which could enable session disruption or malicious data injection into conferencing pipelines but does not directly yield full system compromise. The practical attack surface is narrow: PlainTransport without SRTP is typically used for server-side SFU federation (PipeTransport) or internal media routing rather than direct internet-client connections, limiting mass exploitation risk. WebRtcTransport - the standard path for browser clients - is explicitly immune. This is a real vulnerability warranting prompt patching for affected deployments, but not a critical-priority emergency for organizations not using unprotected PlainTransport or PipeTransport with SCTP.

An attacker with on-path access (e.g., via ARP spoofing on a shared LAN, a compromised network device, or BGP hijack in a datacenter interconnect) between a client and a mediasoup PlainTransport endpoint observes an SCTP handshake, then crafts a COOKIE-ECHO chunk using the publicly known magic values 'msworker' and 0xAD81 and sets the localVerificationTag inside the cookie equal to the SCTP packet header's verification tag field - both values are under attacker control. The forged cookie passes StateCookie::IsMediasoupStateCookie() and the HandleReceivedCookieEchoChunk() verification tag check, establishing a rogue SCTP association from which the attacker injects DataChannel messages that mediasoup treats as originating from a legitimate peer.