Stack Buffer Overflow in libalias RTSP Handler

Executive Summary

CVE-2026-49420 is a buffer overflow vulnerability in the libalias library's RTSP handler. It occurs when the handler rewrites outgoing packets into a fixed-length stack buffer without checking if the data fits, potentially allowing crafted RTSP traffic to trigger a buffer overflow.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses libalias with RTSP handling enabled. Inspect network traffic for packets with source or destination ports 554 or 7070 undergoing NAT translation. Use commands like 'sockstat -l' to check for natd(8) or ipfw(4) processes and 'kldstat' to verify if alias_smedia.ko is loaded.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution in the kernel (if using ipfw(4) NAT) or in the natd(8) process (which runs as root). It requires specific conditions like source or destination ports being 554 or 7070 and outbound NAT translation to be triggered.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to remote code execution in kernel or root-level processes, potentially compromising system integrity and data confidentiality. Such breaches may violate compliance requirements under GDPR (data protection) and HIPAA (health data security) by enabling unauthorized access to sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

For systems running natd(8), remove libalias_smedia.so from /etc/libalias.conf and restart natd(8). For ipfw(4) users, drop packets with ports 554 or 7070 before NAT translation. Apply FreeBSD patches for versions 14.x or 15.x or upgrade to corrected releases.

Useful 0 Not Useful 0