CVE-2025-60458
Double Free Vulnerability in UxPlay RTSP Causes DoS
Publication date: 2025-12-29
Last updated on: 2025-12-29
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| uxplay | uxplay | 1.72 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a double free issue in UxPlay version 1.72. It occurs in the handling of RTSP requests, specifically when processing a specially crafted RTSP TEARDOWN request. The flaw causes the program to call free() multiple times on the same memory address, which can lead to program instability or crashes.
How can this vulnerability impact me? :
The vulnerability can cause a Denial of Service (DoS) by crashing the application or making it unstable when it processes a malicious RTSP TEARDOWN request. This could disrupt service availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for suspicious RTSP TEARDOWN requests that are specially crafted to exploit the double free flaw in UxPlay 1.72. Network traffic analysis tools like tcpdump or Wireshark can be used to capture RTSP traffic and filter for TEARDOWN requests. For example, using tcpdump: tcpdump -i <interface> 'rtsp && rtsp.method == TEARDOWN'. Additionally, checking application logs for crashes or abnormal behavior during RTSP session teardowns may indicate exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting or blocking RTSP TEARDOWN requests from untrusted sources to prevent exploitation. Applying any available patches or updates to UxPlay that address this vulnerability is critical. If patches are not yet available, consider disabling or limiting the use of RTSP services in UxPlay 1.72 until a fix is applied. Monitoring for unusual application crashes and network activity related to RTSP TEARDOWN requests can also help in early detection and response. [1]