CVE-2025-65405: Live555 Use-After-Free Vulnerability

CVE-2025-65405 Overview

CVE-2025-65405 is a use-after-free vulnerability in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media version 2018.09.02. An attacker can trigger the flaw by supplying a crafted Audio Data Transport Stream (ADTS) or Advanced Audio Coding (AAC) file. Successful exploitation causes a Denial of Service (DoS) in applications that link against the vulnerable library. The weakness is classified under CWE-416. Live555 is widely embedded in streaming servers, IP cameras, and multimedia clients, expanding the potential exposure across networked media stacks.

Critical Impact
Remote attackers can crash Live555-based streaming services by delivering a malformed ADTS/AAC file, disrupting availability without requiring authentication.

Affected Products

Live555 Streaming Media version 2018.09.02
Applications and appliances embedding the live555 library for RTSP/RTP streaming
Media servers and IP camera firmware using the ADTSAudioFileSource component

Discovery Timeline

2025-12-01 - CVE-2025-65405 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-65405

Vulnerability Analysis

The flaw resides in the ADTSAudioFileSource::samplingFrequency() method within the Live555 Streaming Media library. Live555 provides a C++ toolkit for RTP/RTSP streaming and parses ADTS-framed AAC audio through the ADTSAudioFileSource class. When the library processes a crafted ADTS/AAC file, memory referenced by samplingFrequency() is freed while a dangling pointer is still dereferenced. The resulting use-after-free corrupts program state and terminates the streaming process.

Because Live555 is commonly reachable over the network via RTSP, an attacker can deliver the malicious media file through a stream URL, playlist, or a controlled RTSP source. The impact is limited to availability, with no confidentiality or integrity loss reported.

Root Cause

The root cause is improper lifetime management of a heap object inside the ADTS parsing path. ADTSAudioFileSource::samplingFrequency() accesses memory that has already been released during file initialization or header parsing. The absence of a null-check or reference-counting guard on the freed object allows the dereference to proceed and crash the process.

Attack Vector

Exploitation requires user interaction, such as opening or streaming an attacker-supplied ADTS/AAC file. The attack vector is network-based, with low attack complexity and no privileges required. An attacker hosts the crafted media, and any Live555-based client or server that ingests the file triggers the use-after-free. Refer to the Live555 GitHub repository for source-level context on the affected component.

Detection Methods for CVE-2025-65405

Indicators of Compromise

Unexpected termination or segmentation faults in processes linking libliveMedia or invoking ADTSAudioFileSource.
Core dumps referencing ADTSAudioFileSource::samplingFrequency in the crash stack trace.
Inbound RTSP or HTTP requests delivering ADTS/AAC payloads from untrusted origins immediately preceding a service crash.

Detection Strategies

Enable Address Sanitizer (ASan) builds of Live555 in test environments to surface use-after-free events on suspicious media samples.
Monitor RTSP and media-serving processes for abnormal restart counts and crash telemetry.
Inspect ADTS headers at network or proxy layers for malformed sampling-frequency indices or truncated frames.

Monitoring Recommendations

Alert on repeated crashes of streaming daemons within short time windows, indicating attempted DoS.
Collect endpoint process telemetry for binaries that load liveMedia shared objects and correlate with inbound media traffic.
Log RTSP session anomalies including malformed SDP, unusual DESCRIBE/PLAY sequences, and oversized ADTS frames.

How to Mitigate CVE-2025-65405

Immediate Actions Required

Inventory systems, appliances, and container images that ship with Live555 Streaming Media 2018.09.02 or older forks.
Restrict RTSP and media ingestion endpoints to trusted networks and authenticated clients where possible.
Disable ADTS/AAC processing paths in Live555-based services if the feature is not required.

Patch Information

No vendor advisory URL is listed in the NVD entry for CVE-2025-65405. Administrators should track upstream fixes through the Live555 GitHub repository and rebuild dependent applications against the patched sources once available. Downstream vendors that embed Live555 in firmware or media servers should be contacted for coordinated updates.

Workarounds

Filter untrusted ADTS/AAC content at a media gateway or reverse proxy before it reaches Live555 parsers.
Run streaming services under process supervisors that isolate crashes and prevent cascading service failures.
Apply seccomp or sandboxing profiles to constrain the impact of a crash in the media parser.

bash

# Configuration example: restrict RTSP exposure with iptables
iptables -A INPUT -p tcp --dport 554 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 554 -j DROP
iptables -A INPUT -p udp --dport 5004:5005 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 5004:5005 -j DROP