A heap-buffer-overflow vulnerability in the ZLMediaKit streaming framework poses a high risk of service disruption if exploited by an unauthenticated remote attacker.

The VP9 RTP payload parser in ZLMediaKit fails to validate buffer bounds when reading fields from the RTP payload, leading to an out-of-bounds read and subsequent heap-buffer-overflow. This flaw is remotely exploitable by an unauthenticated attacker sending a specially crafted VP9 RTP packet.

The exploitation of this vulnerability can lead to a denial of service, rendering the streaming media service unresponsive or crashing the process. Given the CVSS score of 7.5, this represents a significant risk to availability, which could disrupt business operations, live broadcasts, or media delivery services relying on the ZLMediaKit framework.

Immediate Action: Update the ZLMediaKit framework to the version incorporating commit 435dcbcbbf700fd63b2ca9eac6cef3b5ea75169d or higher.

Proactive Monitoring: Monitor streaming traffic logs for malformed RTP packets or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Implement network-level filtering or intrusion detection systems to identify and drop malformed VP9 RTP traffic before it reaches the streaming service.

Public Exploit Available: Unknown.

Due to the critical nature of availability for streaming services and the confirmed existence of proof-of-concept material, administrators should prioritize patching this vulnerability immediately. Upgrading to the corrected version of the ZLMediaKit framework is the only effective way to eliminate the risk of potential heap corruption and service instability.