CVE-2025-65407: Live555 Streaming Media DoS Vulnerability

CVE-2025-65407 Overview

A use-after-free vulnerability has been identified in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02. This memory corruption flaw allows remote attackers to cause a Denial of Service (DoS) condition by supplying a specially crafted MPEG Program stream to the affected application.

Live555 is a widely-used open-source C++ library for multimedia streaming, commonly integrated into various media players, streaming servers, and embedded devices. The vulnerability resides in the MPEG demuxing component, which handles the parsing and processing of MPEG transport streams.

Critical Impact

Remote attackers can crash applications and services utilizing Live555 by sending malicious MPEG streams, potentially disrupting media streaming infrastructure without requiring authentication.

Affected Products

• Live555 Streaming Media v2018.09.02
• Applications and devices integrating vulnerable Live555 library versions
• Streaming servers and media players built with affected Live555 components

Discovery Timeline

• 2025-12-01 - CVE-2025-65407 published to NVD
• 2025-12-02 - Last updated in NVD database

Technical Details for CVE-2025-65407

Vulnerability Analysis

This vulnerability is classified as CWE-416 (Use After Free), a memory corruption class where a program continues to use a pointer after the memory it references has been freed. In the context of Live555's MPEG demuxer, the MPEG1or2Demux::newElementaryStream() function improperly manages memory during elementary stream creation and processing.

The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. This indicates:

• Attack Vector (AV:N): Network-based exploitation
• Attack Complexity (AC:L): Low complexity required
• Privileges Required (PR:N): No authentication needed
• User Interaction (UI:R): Requires user to process malicious stream
• Scope (S:U): Unchanged scope
• Impact: High availability impact with no confidentiality or integrity impact

The EPSS (Exploit Prediction Scoring System) data indicates a probability of 0.049% with a percentile ranking of 15.332, suggesting relatively low exploitation likelihood in the wild.

Root Cause

The root cause lies in improper memory lifecycle management within the MPEG1or2Demux::newElementaryStream() function. When processing MPEG Program streams, the demuxer creates elementary stream objects to handle individual audio or video tracks. The vulnerability occurs when:

1. An elementary stream object is allocated and initialized
2. Under certain error conditions or malformed input, the object is freed prematurely
3. Subsequent code paths continue to reference the freed memory region
4. The dangling pointer is dereferenced, leading to undefined behavior

This use-after-free condition can result in application crashes when the freed memory is accessed, potentially corrupted if reallocated for other purposes.

Attack Vector

The attack vector is network-based, requiring an attacker to deliver a maliciously crafted MPEG Program stream to a vulnerable Live555-based application. Exploitation scenarios include:

1. Direct Stream Delivery: Attacker hosts a malicious MPEG stream that victims connect to via RTSP or other supported protocols
2. File-Based Attack: Attacker distributes a crafted .mpg file that triggers the vulnerability when opened by a vulnerable media player
3. Man-in-the-Middle: Attacker intercepts and modifies legitimate MPEG streams in transit to inject malicious content

The vulnerability is triggered during the demuxing phase when the newElementaryStream() function processes the malformed stream data, causing the application to crash due to the use-after-free condition.

Technical details regarding the specific crafted payload structure can be found in the external security documentation.

Detection Methods for CVE-2025-65407

Indicators of Compromise

• Application crashes or unexpected terminations when processing MPEG streams
• Core dumps or crash logs referencing MPEG1or2Demux or newElementaryStream functions
• Abnormal MPEG stream requests to Live555-based services with malformed headers
• Memory access violations in streaming service logs

Detection Strategies

Network-Based Detection:

• Monitor for malformed MPEG Program stream traffic targeting Live555 services
• Implement deep packet inspection for RTSP sessions carrying suspicious MPEG payloads
• Alert on repeated stream processing failures from single source IPs

Host-Based Detection:

• Enable crash dump collection for Live555-based applications
• Monitor process terminations and restart patterns for streaming services
• Deploy memory corruption detection tools (ASAN, Valgrind) in development/testing environments

SentinelOne Protection:
SentinelOne's behavioral AI engine can detect exploitation attempts through:

• Memory anomaly detection identifying use-after-free patterns
• Process crash monitoring and correlation
• Network payload analysis for malformed media streams

Monitoring Recommendations

Organizations running Live555-based infrastructure should implement:

1. Application Logging: Enable verbose logging in Live555 applications to capture stream processing errors
2. Service Health Monitoring: Configure alerting for unexpected service restarts or crashes
3. Network Traffic Analysis: Deploy IDS/IPS rules to detect malformed MPEG stream patterns
4. Resource Monitoring: Track memory usage patterns that may indicate exploitation attempts

How to Mitigate CVE-2025-65407

Immediate Actions Required

• Identify all systems running Live555 Streaming Media v2018.09.02 or integrating this library version
• Restrict network access to Live555-based services to trusted sources where possible
• Implement input validation at the network perimeter for MPEG stream traffic
• Enable application crash monitoring and alerting for affected services
• Consider deploying Web Application Firewalls (WAF) or reverse proxies to filter malicious payloads

Patch Information

Organizations should check the official Live555 repository for updates addressing this vulnerability. The library source code is maintained at the Live555 GitHub repository.

Recommended steps:

1. Monitor the Live555 project for security patches addressing CVE-2025-65407
2. Test updated library versions in a staging environment before production deployment
3. Recompile applications that statically link Live555 with patched versions
4. Update dynamically linked library files on affected systems

Workarounds

If immediate patching is not feasible, consider the following risk reduction measures:

Network Segmentation:
Isolate Live555-based services from untrusted networks. Restrict RTSP and streaming ports to known-good client IP addresses.

Input Filtering:
Deploy upstream filtering to reject malformed or suspicious MPEG streams before they reach vulnerable applications.

Service Hardening:
Run Live555 applications with reduced privileges and resource limits to minimize crash impact. Implement automatic service restart with rate limiting.

# Example: Configure resource limits for Live555 service
# /etc/systemd/system/live555-server.service.d/limits.conf
[Service]
LimitNOFILE=1024
LimitCORE=0
MemoryMax=512M
Restart=on-failure
RestartSec=5s