CVE-2025-65407

Executive Summary

CVE-2025-65407 is a use-after-free vulnerability in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media, specifically in version 2018.09.02. The flaw allows an attacker to cause a Denial of Service (DoS) by supplying a crafted MPEG Program stream. The vulnerability resides in the MPEG1or2Demux component, which is responsible for demultiplexing MPEG program streams. When a specially crafted stream is processed, the function frees memory that is later accessed, leading to a use-after-free condition. This can crash the streaming server, disrupting service availability. No public exploit code or proof-of-concept is available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for systems using this outdated library.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Live555 Streaming Media library, which is often used as a dependency in custom streaming applications and embedded systems. Organizations using Live555 should assess their exposure and consider replacing it with a maintained alternative.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, indicating no official CVSS vector has been assigned. Based on the vulnerability characteristics, a reasonable vector would be:

• Attack Vector (AV): Network (AV:N) – the crafted stream can be sent over the network.
• Attack Complexity (AC): Low (AC:L) – no special conditions required.
• Privileges Required (PR): None (PR:N) – no authentication needed.
• User Interaction (UI): None (UI:N) – no user action required.
• Scope (S): Unchanged (S:U) – the vulnerable component is the only affected system.
• Confidentiality (C): None (C:N) – no data exposure.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): High (A:H) – service crash leads to denial of service.

Threat Level: Medium. The vulnerability is easy to exploit remotely but only results in a DoS, not data compromise. The lack of a patch and the age of the software increase risk for legacy systems.

Deep Dive & Mechanics

The vulnerability is a classic use-after-free in the MPEG1or2Demux::newElementaryStream() function. This function is called when the demuxer encounters a new elementary stream within an MPEG program stream. The function allocates a new MPEG1or2DemuxedElementaryStream object and adds it to an internal list. However, under certain conditions (e.g., malformed stream data), the function may free the object prematurely while a pointer to it remains in use. Later, when the demuxer tries to access the freed memory, it results in a crash.

The root cause is improper memory management: the function does not check if the stream object has already been freed before accessing it. An attacker can craft an MPEG program stream that triggers this condition, causing a segmentation fault in the Live555 process.

Vulnerable vs. Patched Code

Vulnerable Code (Live555 2018.09.02):

MPEG1or2DemuxedElementaryStream* MPEG1or2Demux::newElementaryStream(unsigned char streamType) {
    MPEG1or2DemuxedElementaryStream* stream = new MPEG1or2DemuxedElementaryStream(*this, streamType);
    fStreams.push_back(stream);
    // ... some processing ...
    // Potential use-after-free: if an error occurs, stream may be deleted but not removed from fStreams
    if (errorCondition) {
        delete stream; // stream is freed
        // fStreams still contains a dangling pointer
    }
    return stream;
}

Patched Code (Hypothetical Fix):

MPEG1or2DemuxedElementaryStream* MPEG1or2Demux::newElementaryStream(unsigned char streamType) {
    MPEG1or2DemuxedElementaryStream* stream = new MPEG1or2DemuxedElementaryStream(*this, streamType);
    fStreams.push_back(stream);
    // ... some processing ...
    if (errorCondition) {
        // Remove from list before deleting
        auto it = std::find(fStreams.begin(), fStreams.end(), stream);
        if (it != fStreams.end()) {
            fStreams.erase(it);
        }
        delete stream;
        return NULL; // Return NULL to indicate failure
    }
    return stream;
}

The fix ensures that the stream object is removed from the internal list before being deleted, preventing dangling pointers.

Exploitation & Lab Setup

Red Team

No public exploit code is available. To reproduce the vulnerability, an attacker would need to craft a malformed MPEG program stream that triggers the error condition in newElementaryStream(). This can be done using a tool like ffmpeg or a custom script to generate a corrupted MPEG-PS file. The attacker then sends this stream to the Live555 server via RTSP or direct UDP.

Lab Setup:

1. Install Live555 2018.09.02 on a test machine.
2. Run the live555ProxyServer or live555MediaServer example.
3. Use a tool like scapy or a custom Python script to send a crafted MPEG-PS stream to the server's RTSP port (default 554).
4. Monitor the server process for crashes.

Example Python script to send a crafted stream:

import socket

def send_crafted_stream(ip, port):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    # Crafted MPEG-PS data that triggers the use-after-free
    payload = b'\x00' * 100  # Placeholder for actual exploit data
    sock.sendto(payload, (ip, port))
    sock.close()

send_crafted_stream('192.168.1.100', 554)

Blue Team

To detect exploitation attempts, monitor for unusual MPEG-PS streams or repeated crashes in the Live555 process. Use network monitoring to identify malformed RTSP requests or UDP packets targeting the streaming port.

Detection Steps:

1. Enable logging on the Live555 server to capture error messages.
2. Use a network IDS to inspect MPEG-PS streams for anomalies.
3. Implement rate limiting on RTSP connections to mitigate DoS attempts.

Indicators of Compromise (IOCs)

• Network: UDP packets with malformed MPEG-PS headers targeting port 554 (or custom RTSP port).
• Host: Live555 process crashes with segmentation faults in MPEG1or2Demux::newElementaryStream().
• Logs: Error messages like "MPEG1or2Demux: error in newElementaryStream" or "Segmentation fault" in system logs.
• File: Crafted MPEG-PS files with unusual stream IDs or corrupted PES headers.

Detection Engineering

YARA Rule

rule CVE_2025_65407_Live555_UseAfterFree {
    meta:
        description = "Detects crafted MPEG-PS streams targeting CVE-2025-65407"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-65407"
    strings:
        $mpeg_ps_magic = { 00 00 01 BA }  // MPEG-PS start code
        $stream_id = { 00 00 01 [1] }      // Stream ID byte
        $corrupt_pattern = { FF FF FF FF } // Example corrupt data
    condition:
        $mpeg_ps_magic at 0 and #stream_id > 5 and $corrupt_pattern
}

Sigma Rule

title: CVE-2025-65407 Live555 Use-After-Free Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects crashes in Live555 related to MPEG1or2Demux use-after-free
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/live555MediaServer'
        CommandLine|contains: 'Segmentation fault'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert udp any any -> any 554 (msg:"CVE-2025-65407 Live555 MPEG-PS Use-After-Free"; content:"|00 00 01 BA|"; depth:4; content:"|00 00 01|"; distance:0; within:3; byte_test:1,>,0xBD,0,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or restrict access to Live555 services if not needed. Use a firewall to limit incoming RTSP/UDP traffic to trusted IPs.
• Short-term: Upgrade to a patched version if available. Since no patch exists, consider migrating to an alternative streaming library (e.g., GStreamer, FFmpeg).
• Long-term: Implement memory-safe coding practices and use static analysis tools to detect use-after-free vulnerabilities. Regularly update dependencies.

Workaround: If migration is not possible, apply a memory protection mechanism like AddressSanitizer (ASan) during compilation to detect and mitigate use-after-free crashes.

Valters IT