Use-after-free in Apache bRPC - CVE-2026-74758
Published: October 23, 2026
Vulnerability identifier: #VU157349
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-74758
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing a bRPC RTMP server.
The vulnerability exists due to use-after-free in Apache bRPC's RTMP Abort message handling when an Abort message deletes the chunk stream whose Feed() method is currently running. A remote attacker can send an Abort control message naming its own carrying chunk stream to make Feed() access the deleted object after the handler returns and crash the process.
Affected software
Apache bRPC
How to mitigate CVE-2026-74758
Install security update from vendor's website.
Apache bRPC - update to 1.18.0