CVE-2026-38998: LIVE555 Streaming Media Use-After-Free DoS

CVE-2026-38998 Overview

CVE-2026-38998 is a use-after-free vulnerability in the SocketDescriptor::tcpReadHandler1 function located in liveMedia/RTPInterface.cpp of LIVE555 Streaming Media version 2026.02.26. Attackers can trigger the flaw remotely by sending a crafted sequence of Real Time Streaming Protocol (RTSP) and HTTP requests to the server. Successful exploitation causes a Denial of Service (DoS) condition against the streaming media process. LIVE555 is widely embedded in IP cameras, network video recorders, and streaming appliances, expanding the exposure surface across consumer and enterprise deployments.

Critical Impact
Remote unauthenticated attackers can crash LIVE555-based streaming servers by sending crafted RTSP and HTTP request sequences, disrupting video and media services.

Affected Products

LIVE555 Streaming Media version 2026.02.26
Applications and appliances embedding vulnerable LIVE555 liveMedia components
Streaming media servers exposing RTSP over TCP with HTTP tunneling enabled

Discovery Timeline

2026-09-09 - CVE-2026-38998 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-38998

Vulnerability Analysis

The vulnerability resides in SocketDescriptor::tcpReadHandler1, a handler in liveMedia/RTPInterface.cpp responsible for processing incoming TCP data on sockets shared by RTSP and RTSP-over-HTTP tunneling. The function operates on a SocketDescriptor object that can be freed while still referenced by a pending read callback. When the freed object is dereferenced during subsequent request handling, memory corruption occurs and the server process terminates. The condition is a classic use-after-free [CWE-416] triggered by a race between session teardown and socket read events.

Root Cause

The root cause is improper lifetime management of the SocketDescriptor structure. Object cleanup runs during specific RTSP or HTTP control transitions without invalidating the associated read handler registration. A follow-on read event then executes tcpReadHandler1 against a dangling pointer, dereferencing freed heap memory.

Attack Vector

An unauthenticated remote attacker with network reachability to the streaming port sends a crafted series of RTSP and HTTP requests. The sequence forces the server to release a SocketDescriptor while a pending TCP read is dispatched against the same object, corrupting memory and terminating the LIVE555 process. Because LIVE555 typically runs single-threaded within the streaming daemon, the crash halts all active sessions. Refer to the GitHub LIVE555 Security Advisory and the Live555 Development Mailing List for technical background.

No verified public exploit code is available at time of publication. The vulnerability is described in prose based on the vendor advisory and mailing list disclosure.

Detection Methods for CVE-2026-38998

Indicators of Compromise

Unexpected termination or repeated restarts of LIVE555-based streaming daemons
Crash reports referencing SocketDescriptor::tcpReadHandler1 or RTPInterface.cpp in core dumps
Bursts of mixed RTSP and HTTP requests to the streaming port from a single remote source
Client-side RTSP session drops correlating with server process exit

Detection Strategies

Monitor process supervisors and systemd journals for LIVE555 service restarts and abnormal exit codes
Deploy network intrusion detection signatures that flag anomalous RTSP-over-HTTP tunneling patterns and rapid session teardowns
Enable AddressSanitizer or equivalent instrumentation in test environments to confirm the use-after-free path during triage

Monitoring Recommendations

Alert on repeated TCP connection resets followed by service restart events on RTSP ports (typically 554 and 8554)
Aggregate streaming server crash telemetry into a centralized log platform for correlation across fleets
Track source IPs generating high volumes of short-lived RTSP SETUP and HTTP GET/POST tunneling requests

How to Mitigate CVE-2026-38998

Immediate Actions Required

Inventory all systems and appliances running LIVE555 Streaming Media, including embedded firmware in IP cameras and NVRs
Restrict network access to RTSP and HTTP tunneling ports using firewalls and network segmentation
Disable RTSP-over-HTTP tunneling on servers where it is not required
Monitor upstream vendors for firmware updates incorporating the fixed LIVE555 release

Patch Information

Consult the Live555 Change Log for the corrected release that addresses the SocketDescriptor::tcpReadHandler1 use-after-free. Upgrade LIVE555 to a version published after 2026.02.26 that includes the fix, then rebuild and redeploy any downstream applications that statically link the library. Device vendors should ship firmware updates incorporating the patched library.

Workarounds

Place LIVE555 servers behind a reverse proxy or media gateway that terminates RTSP and HTTP sessions and filters malformed request sequences
Restrict RTSP access to authenticated clients on trusted network segments only
Configure process supervision to automatically restart the streaming daemon after a crash to reduce service downtime while a patch is applied

bash

# Example: restrict RTSP access with iptables to trusted management subnet
iptables -A INPUT -p tcp --dport 554 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 554 -j DROP
iptables -A INPUT -p tcp --dport 8554 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8554 -j DROP