CVE-2026-0161

Executive Summary

CVE-2026-0161 is a critical integer overflow vulnerability in the numberOfReportBlocks function within RtpSession.cpp of the Numberofreportblocks library. The flaw allows an attacker to trigger an out-of-bounds write via a crafted RTSP packet, leading to remote code execution (RCE) without authentication or user interaction. The vulnerability resides in the RTSP session handling logic, where an integer overflow in the calculation of report block sizes can corrupt heap memory. No public exploit or patch is currently available, but the high CVSS score and network-based attack vector make this a priority for detection and mitigation.

Supply Chain & Package Security

This vulnerability affects the Numberofreportblocks library, which is commonly used in RTSP server implementations. Organizations using RTSP-based streaming services should audit their dependencies for this library and monitor for patches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over RTSP.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not cross trust boundaries.
• Confidentiality (C): High (H) – Potential memory read.
• Integrity (I): High (H) – Arbitrary write possible.
• Availability (A): High (H) – Crash or RCE.

Threat Level: Critical – Remote, unauthenticated, no user interaction.

Deep Dive & Mechanics

The vulnerability is in the numberOfReportBlocks function of RtpSession.cpp. This function calculates the number of report blocks in an RTCP packet. The calculation involves multiplying a user-controlled value by a fixed block size. If the attacker sends a crafted RTCP packet with a large block count, the multiplication can overflow a 32-bit integer, resulting in a small or negative value. This value is then used as a size parameter in a memory allocation or copy operation, leading to a heap buffer overflow.

Root Cause: Integer overflow in numberOfReportBlocks due to missing bounds check on the block count field.

Attack Flow:

1. Attacker sends a malicious RTCP packet to the target RTSP server.
2. The server parses the packet and calls numberOfReportBlocks with a crafted block count.
3. Integer overflow occurs, producing an incorrect (small) size.
4. The server allocates a buffer of that small size.
5. The server then writes report block data into the buffer, causing an out-of-bounds write.
6. Attacker overwrites adjacent heap metadata or function pointers, achieving RCE.

Vulnerable vs. Patched Code

Vulnerable Code (pseudocode):

int numberOfReportBlocks(uint8_t* packet) {
    uint32_t blockCount = (packet[2] & 0x1F); // 5-bit field
    uint32_t size = blockCount * sizeof(ReportBlock); // overflow possible
    // ... allocate buffer of size ...
}

Patched Code (expected):

int numberOfReportBlocks(uint8_t* packet) {
    uint32_t blockCount = (packet[2] & 0x1F);
    if (blockCount > MAX_BLOCKS) return -1; // bounds check
    uint32_t size = blockCount * sizeof(ReportBlock);
    // ... safe allocation ...
}

Exploitation & Lab Setup

Red Team (Exploitation)

No public exploit code is available. However, a proof-of-concept can be developed:

1. Craft an RTCP packet with a block count field set to a value that causes overflow (e.g., 0x1F * sizeof(ReportBlock) > 2^32).
2. Send the packet to the target RTSP server on port 554.
3. Monitor for heap corruption or crash.

Lab Setup:

• Target: RTSP server using Numberofreportblocks library (e.g., custom build).
• Attacker: Kali Linux with Python/Scapy for packet crafting.
• Network: Isolated lab network.

Example Python script (conceptual):

import socket
import struct

def exploit(target_ip, target_port=554):
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((target_ip, target_port))
    # Craft RTCP packet with overflow trigger
    packet = b'\x80\xc9\x00\x1f'  # header with blockCount=31
    packet += b'A' * 1000  # padding
    sock.send(packet)
    sock.close()

Blue Team (Detection & Defense)

• Monitor RTSP traffic for anomalous RTCP packets with high block counts.
• Deploy WAF rules to block RTCP packets with blockCount > 20.
• Enable heap canaries and ASLR on the server.

Indicators of Compromise (IOCs)

• Network: RTCP packets with block count field > 20 (0x14).
• Host: Heap corruption errors in logs (e.g., "malloc(): memory corruption").
• Process: Crash of RTSP server process (e.g., segmentation fault in RtpSession.cpp).
• File: Modified heap metadata in memory dumps.

Detection Engineering

YARA Rule

rule CVE_2026_0161_RTCP_Overflow {
    meta:
        description = "Detects RTCP packets with high block count indicative of CVE-2026-0161"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $rtcp_header = { 80 c9 ?? ?? }
        $high_block = { ?? ?? ?? 1f } // blockCount = 31
    condition:
        $rtcp_header and $high_block
}

Sigma Rule

title: CVE-2026-0161 RTCP Integer Overflow
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects RTCP packets with block count > 20
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_proto: rtcp
        rtcp.block_count: >20
    condition: selection
falsepositives:
    - Legitimate high-bandwidth RTCP sessions
level: high

Suricata Rule

alert tcp any any -> any 554 (msg:"CVE-2026-0161 RTCP Integer Overflow"; flow:to_server; content:"|80 c9|"; offset:0; depth:2; content:"|1f|"; within:1; distance:2; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Apply vendor patch when available. Monitor Numberofreportblocks repository for updates.
2. Workaround: Disable RTCP support in RTSP server if not required.
3. Network: Block RTCP packets with block count > 20 at the firewall.
4. Compile-time: Enable integer overflow checks (e.g., -ftrapv in GCC).
5. Runtime: Use AddressSanitizer (ASan) during development.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst
Report generated: 2025-04-10