CVE-2018-4013

PoC —

CVSS 3.1

9.8 critical

EPSS

10%p95

Published

Oct 19, 2018 (Oct 19, 2018)

Modified

Jun 17, 2026

Description

An exploitable code execution vulnerability exists in the HTTP packet-parsing functionality of the LIVE555 RTSP server library version 0.92. A specially crafted packet can cause a stack-based buffer overflow, resulting in code execution. An attacker can send a packet to trigger this vulnerability.

Vendors: live555 debian
Products: live555 media server, debian linux
Weakness: CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (9.7%)

In the news3 stories

Critical Code Execution Flaw Found in LIVE555 Streaming Library

The Hacker NewsOct 22, 16:46 UTC · Oct 22, 2018Vulnerability CVE-2018-4013

MPlayer and VLC media player affected by critical flaw CVE-2018

Security AffairsOct 22, 07:15 UTC · Oct 22, 2018Vulnerability CVE-2018-4013

Vulnerability Spotlight: Live Networks LIVE555 streaming media RTSPServer code execution vulnerability

Cisco TalosOct 18, 14:48 UTC · Oct 18, 2018Vulnerability CVE-2018-4013