CVE-2026-35203

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-35203

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35203.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-35203

Aliases

GHSA-gxr3-fwc7-q99h

Published

2026-04-06T19:54:45.052Z

Modified

2026-08-24T03:59:12.010654Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

ZLMediaKit VP9 RTP Parser Out-of-Bounds Read

Details

ZLMediaKit is a streaming media service framework. the VP9 RTP payload parser in ext-codec/VP9Rtp.cpp reads multiple fields from the RTP payload based on flag bits in the first byte, without verifying that sufficient data exists in the buffer. A crafted VP9 RTP packet with a 1-byte payload (0xFF, all flags set) causes the parser to read past the end of the allocated buffer, resulting in a heap-buffer-overflow. This vulnerability is fixed with commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35203.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d"
                }
            ]
        }
    ],
    "cwe_ids": [
        "CWE-125"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/zlmediakit/zlmediakit

Affected ranges

Type

GIT

Repo

https://github.com/zlmediakit/zlmediakit

Events

Introduced

Fixed

435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

vanir_signatures

[
    {
        "id": "CVE-2026-35203-cd64b282",
        "target": {
            "function": "VP9RtpDecoder::decodeRtp",
            "file": "ext-codec/VP9Rtp.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "258717882410040396913537876958198852610",
            "length": 766.0
        },
        "signature_version": "v1",
        "source": "https://github.com/zlmediakit/zlmediakit/commit/435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-35203-e3862a75",
        "target": {
            "function": "RTPPayloadVP9::parse",
            "file": "ext-codec/VP9Rtp.cpp"
        },
        "deprecated": false,
        "digest": {
            "function_hash": "281722551504849388086115956845544698495",
            "length": 2068.0
        },
        "signature_version": "v1",
        "source": "https://github.com/zlmediakit/zlmediakit/commit/435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d",
        "signature_type": "Function"
    },
    {
        "id": "CVE-2026-35203-eed95cf6",
        "target": {
            "file": "ext-codec/VP9Rtp.cpp"
        },
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "68727550765386503878554445499225644279",
                "225772907824085979473977862366414526751",
                "32124426029648688871090975236460002104",
                "287902914284095827066290317120462426179",
                "322991568468495192210273473194322542275",
                "228965578513133427122550520235974175048",
                "84201656213927853850719287413084173046",
                "222810554772149594249931824643951398848",
                "186299688038694628908513498196679041368",
                "45043892198462049010397771383752295910",
                "130623892824038841836777677012464944841",
                "10222967381041982520286811613295750067",
                "244666630687213779787886355592560770673",
                "259127119718616719562665665957131127541",
                "67809424293268704712902518799292358288",
                "85900714123334670747338184631956946661",
                "197157609517914394958651528904112889016",
                "27104009338996721067732924929816731348",
                "35367682741325860105763098807493553545",
                "88903788424140303223589865508313700922",
                "116335171822889953262804220794387937187",
                "147186060393568674371329246704045326164",
                "142700915461432063101325607920524793493",
                "209091410753730314378891871935248979488",
                "226950012846710873552457883385226013772",
                "208655511415778722216382337062929568385",
                "243165474168203649558950861144677317970",
                "9941830407839498434842731905174432000",
                "104614157264967930109953203515032559176",
                "72729803239924559282659596130380412235",
                "137722692271279093275911671130826889463",
                "114253520917539108315545743141648173386",
                "70789442259339208694702936893170309355",
                "278821962580248219786790096113184522100",
                "105447394672515931000016525382226620183",
                "170514758158391482667956857907987783670",
                "65271709797993156905327878581066820001",
                "168555503036284864212138342652735825488",
                "147196799884412713301752372648360442778",
                "305164602788622487838813931209926086868",
                "41664910034856314828494939222670206629",
                "24098045174178990253434989669756315484",
                "134142255655048276548202295062475187274",
                "155640738141574900500572502493630099140",
                "240581480665562005004010934793919867662",
                "185022940454940613690569018235053100185",
                "231586490819788768562929622051092659746",
                "225475946605499512776430603292131693211",
                "199944867172363642734330597666888713162",
                "300375608645298731051614345077943252110",
                "12584312955103328694711549506948441472",
                "311103465720484973251291180222258998624",
                "96210548902809984854315775206359920380",
                "51945665789283038517064773277824627443",
                "127270496637856942280120407835450587749",
                "164598106071458215414190283088040939749",
                "2760119766038298010692436314928934950",
                "234830956442235235751348872527677151630"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/zlmediakit/zlmediakit/commit/435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d",
        "signature_type": "Line"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35203.json"

vanir_signatures_modified

"2026-08-24T03:59:12Z"