CVE-2023-37117: Critical Use-After-Free in live555 RTSP

CVE-2023-37117 is a critical heap use-after-free (CVSS 9.8) in live555 version 2023.05.10, reported in the code that handles RTSP SETUP requests. No fixed version is confirmed in the record, so move to the latest live555 release and check the project changelog.

What's affected

• Product: live555 (LIVE555 Streaming Media), a C++ library for RTSP, RTP and related streaming protocols.
• Affected version: 2023.05.10, the version named in the record.
• Fixed version: not confirmed. The record points to a project changelog, but that page could not be retrieved when this post was written, so check it directly.
• Severity: Critical, CVSS 9.8, network attack vector, low complexity, no privileges, no user interaction.
• Exploited in the wild: the record's CISA KEV flag is false.

One source conflict is worth stating. The NVD record calls the flaw a heap-use-after-free. The live-devel mailing list thread the record cites is titled as a stack-use-after-return while handling SETUP in the same version. Both involve SETUP handling in 2023.05.10, but the memory error class differs between the two. The record's weakness is CWE-416, use after free. Rely on the project's changelog for what was actually changed.

How to check if you're exposed

live555 is a library, so it is often compiled into other software. Look in three places:

• Your own build: search the source tree or vendored dependencies for live555 or the LIVE555 version string.
• Your SBOM or dependency inventory, for packages named live555 or liblivemedia.
• Products you run that serve or ingest RTSP, such as cameras, media servers and players. Ask the vendor whether they embed live555 and which release.

grep -ri "live555" --include=*.txt --include=*.cmake --include=Makefile* .
ls /usr/lib | grep -i livemedia

A server built on the library that accepts RTSP from untrusted clients is the case to worry about most.

What to do now

1. Find every build and product that embeds live555 2023.05.10.
2. Update to the latest live555 release and read the changelog entries after 2023.05.10 for the SETUP fix. If you rely on a distribution package, check the distribution's security tracker for a backported patch.
3. Do not expose RTSP servers to the internet unless you need to. Put them behind a firewall or VPN.
4. Ask vendors of embedded products for their fixed firmware or software version.
5. Re-scan after updating to confirm the old version is gone.

Why it matters

A use-after-free means the program keeps using memory after it has been released. The memory may then hold something else, so reads and writes can corrupt data or change program behavior. On a network service that parses requests from clients, that class of bug scores high because the input comes from anyone who can reach the port.

The CVSS rating of 9.8 reflects that reach. Whether a given product is actually exposed depends on whether it runs the RTSP server code and who can connect, which is where reachability analysis helps: a copy of the library that your code never calls the server paths of is a different priority from a listener on an open port.

Safeguard can help with the inventory side of this work. The free in-browser dependency scan at gold.safeguard.sh/scan checks the packages in a manifest against known CVEs, and the Gold directory keeps a page per CVE and per weakness class so you can see related issues in one place. Reachability analysis then helps you separate a package that is merely present from one your code actually calls.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• NVD record for CVE-2023-37117
• Safeguard Gold page
• live-devel mailing list thread cited by the record
• live555 changelog cited by the record (could not be retrieved at the time of writing)

Last reviewed: 19 October 2026.