CVE-2025-65405
📋 TL;DR
This vulnerability allows attackers to cause a Denial of Service (DoS) by exploiting a use-after-free bug in Live555's ADTS/AAC file parsing. Attackers can crash the media streaming service by supplying a specially crafted audio file. This affects systems running Live555 Streaming Media software for audio/video streaming.
💻 Affected Systems
- Live555 Streaming Media
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of media streaming applications, potentially affecting multiple users or downstream services.
Likely Case
Application crash requiring restart, causing temporary service interruption for streaming clients.
If Mitigated
Limited impact with proper input validation and sandboxing, potentially only affecting isolated components.
🎯 Exploit Status
Exploitation requires crafting a malicious ADTS/AAC file; no authentication needed if file processing is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Monitor Live555 repository for security updates. 2. Apply patch when available. 3. Restart affected services after patching.
🔧 Temporary Workarounds
Input Validation Filter
allImplement strict validation of ADTS/AAC files before processing
# Implement file validation in application code before passing to Live555
Process Isolation
linuxRun Live555 in isolated containers or sandboxes to limit crash impact
docker run --security-opt=no-new-privileges -d live555-container
🧯 If You Can't Patch
- Implement network segmentation to isolate Live555 services
- Deploy WAF or reverse proxy with file type filtering for ADTS/AAC
🔍 How to Verify
Check if Vulnerable:
Check if using Live555 version 2018.09.02 or earlier with ADTS/AAC support enabledCheck Version:
Check application documentation or build information for Live555 versionVerify Fix Applied:
Test with known malicious ADTS/AAC files after applying updates📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Segmentation faults in Live555 processes
- Unexpected process termination
Network Indicators:
- Unusual ADTS/AAC file uploads
- Streaming service interruptions
SIEM Query:
process_name:"live555" AND (event_type:crash OR exit_code:139)