CVE-2025-65405: Live555 Use-After-Free Vulnerability

CVE-2025-65405 Overview

A use-after-free vulnerability exists in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02. This memory corruption flaw allows attackers to cause a Denial of Service (DoS) condition by supplying a specially crafted ADTS/AAC audio file. The vulnerability is classified as CWE-416 (Use After Free) and carries a CVSS 3.1 score of 6.5 (MEDIUM severity).

Critical Impact

Attackers can exploit this use-after-free vulnerability to crash Live555 streaming services by providing malicious ADTS/AAC files, resulting in service disruption for media streaming applications.

Affected Products

• Live555 Streaming Media v2018.09.02
• Applications and services built on the Live555 media streaming library
• RTSP servers and media streaming infrastructure utilizing vulnerable Live555 versions

Discovery Timeline

• 2025-12-01 - CVE-2025-65405 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-65405

Vulnerability Analysis

This vulnerability is a use-after-free (UAF) condition affecting the ADTSAudioFileSource::samplingFrequency() function within the Live555 Streaming Media library. Use-after-free vulnerabilities occur when a program continues to reference memory after it has been freed, leading to undefined behavior. In this case, the vulnerability can be triggered when the library processes maliciously crafted ADTS (Audio Data Transport Stream) or AAC (Advanced Audio Coding) audio files.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H indicates:

• Attack Vector (AV:N): Network-based exploitation is possible
• Attack Complexity (AC:L): Low complexity to exploit
• Privileges Required (PR:N): No authentication needed
• User Interaction (UI:R): Requires user interaction (e.g., opening a malicious file)
• Impact: High availability impact with no confidentiality or integrity impact

The EPSS (Exploit Prediction Scoring System) probability is 0.049% with a percentile ranking of 15.332, indicating a relatively low likelihood of exploitation in the wild.

Root Cause

The root cause lies in improper memory management within the ADTSAudioFileSource::samplingFrequency() function. When processing ADTS/AAC audio streams, the function accesses memory that has already been deallocated, resulting in a use-after-free condition. This typically occurs due to incorrect object lifecycle management or missing validation of object state before memory access.

Live555 is a widely-used C++ library for streaming media, and memory management issues in such libraries can have broad implications for applications built upon them, including RTSP servers, media players, and IoT devices with streaming capabilities.

Attack Vector

The attack vector is network-based with a requirement for user interaction. An attacker would need to craft a malicious ADTS/AAC audio file and entice a victim to process it through an application using the vulnerable Live555 library. The exploitation flow involves:

1. Attacker creates a specially crafted ADTS/AAC file designed to trigger the use-after-free condition
2. The malicious file is delivered to the target through various means (email attachment, web download, streaming URL)
3. When the victim's application processes the file, the ADTSAudioFileSource::samplingFrequency() function is invoked
4. The use-after-free condition is triggered, causing the application to crash and resulting in denial of service

The vulnerability mechanism involves memory corruption through improper object lifecycle handling in the audio file source processing code. When a crafted ADTS/AAC file is processed, the sampling frequency accessor function attempts to read from memory that has already been freed, leading to application instability and crashes. For detailed technical analysis, refer to the security documentation and the Live555 repository.

Detection Methods for CVE-2025-65405

Indicators of Compromise

• Unexpected crashes in applications using Live555 library during ADTS/AAC file processing
• Core dumps or crash reports referencing ADTSAudioFileSource::samplingFrequency() function
• Abnormal memory access patterns or segmentation faults in media streaming services

Detection Strategies

Organizations can implement several detection strategies to identify potential exploitation attempts:

1. Memory Analysis: Monitor for use-after-free patterns using memory debugging tools like AddressSanitizer (ASan) or Valgrind during development and testing
2. Crash Monitoring: Implement crash reporting and analysis for applications using Live555 to detect patterns indicative of exploitation attempts
3. File Inspection: Implement input validation and scanning for malformed ADTS/AAC files before processing
4. Application Logging: Enable verbose logging for media processing functions to capture anomalous behavior

SentinelOne Singularity platform provides behavioral detection capabilities that can identify memory corruption exploitation attempts, including use-after-free attacks against media processing components.

Monitoring Recommendations

• Deploy endpoint detection and response (EDR) solutions capable of detecting memory corruption attacks
• Monitor process behavior for unexpected crashes in media streaming applications
• Implement network monitoring to detect delivery of potentially malicious media files
• Enable application whitelisting to control which media files can be processed
• Configure SentinelOne agents to monitor for behavioral indicators of memory exploitation in streaming media applications

How to Mitigate CVE-2025-65405

Immediate Actions Required

• Identify all systems and applications using Live555 Streaming Media library v2018.09.02 or earlier
• Update Live555 to a patched version that addresses this use-after-free vulnerability
• Implement input validation for ADTS/AAC files before processing with Live555

Patch Information

Organizations should update to the latest version of the Live555 Streaming Media library. The Live555 project maintains updates through their official channels. Check the Live555 GitHub repository for the latest releases and security patches.

Verify your current Live555 version and compare against patched releases. Prioritize updating production systems, especially those exposed to untrusted media content or network-accessible streaming services.

Workarounds

If immediate patching is not possible, consider the following temporary mitigations:

• Restrict processing of ADTS/AAC files from untrusted sources
• Implement network segmentation to isolate media streaming services
• Deploy application-level firewalls to filter potentially malicious media content
• Enable crash recovery mechanisms to minimize service disruption
• Monitor for exploitation attempts using EDR solutions

# Configuration example - Restrict file types in web server (nginx)
location /media/ {
    # Validate file extensions before processing
    if ($request_filename ~* \.(aac|adts)$) {
        # Add additional validation or scanning before processing
        return 403;
    }
}