CVE-2026-49420

The libalias RTSP handler rewrites outgoing packets into a fixed-length stack buffer without bounds checking. A host inside a NAT gateway can trigger a stack overflow via crafted RTSP traffic, potentially achieving RCE in the kernel (ipfw(4) NAT) or root-owned natd(8). FreeBSD advisory FreeBSD-SA...

CVE-2026-49420 Buffer overflow in libalias RTSP handler

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...