SRT Alliance Security Advisory

Overview

Two critical security vulnerabilities (CVSS 9.1) have been identified and patched in the open-source SRT protocol library. Two CVEs have been published for these vulnerabilities.

• CVE-2026-55869: Heap-Based Buffer Overflow in KMREQ Handling
• CVE-2026-55868: Encryption State Machine Downgrade

 

Note: The CVE records (CVE-2026-55869 and CVE-2026-55868) are currently “reserved” and pending publication by the CVE Numbering Authority. Due to high volume across the industry, publication is expected within approximately three weeks. The full vulnerability details, CVSS scores, and remediation guidance on this page are complete and accurate — the published CVE records will contain the same information. Once published, organizations using automated vulnerability monitoring tools will be notified through their standard scanning workflows.

It is recommended that you take immediate remediation action by updating to SRT protocol library v1.5.6, which contains fixes for both vulnerabilities.

The vulnerabilities affect all versions of the SRT protocol library prior to v1.5.6.

Description of Vulnerability CVE-2026-55869

CVE-2026-55869	Heap-Based Buffer Overflow in KMREQ Handling
CVSS v3.1	9.1 (Critical)
Affected Software	Open-source SRT protocol library — all versions prior to 1.5.6
Attack Vector	Network — single crafted UDP packet to any SRT endpoint (sender or receiver) during connection setup or key refresh
Authentication	None
Impact	Denial of service (immediate process crash), potential remote code execution

 

Technical Description: A heap-based buffer overflow exists in the SRT protocol library when processing KMREQ control packets during connection setup and key refresh operations. A remote attacker can send a specially crafted packet that causes the SRT process to crash. No valid credentials, passphrase, or completed handshake are required.

What Is Affected by CVE-2026-55869

• All SRT endpoints (senders and receivers) in any connection mode — Endpoints with listening ports accessible from untrusted networks are at highest risk. Endpoints in any mode are vulnerable if the attacker can observe the session’s 5-tuple.

What Is Not Affected by CVE-2026-55869

• Deployments where SRT endpoints are not accessible from untrusted networks or systems – significantly reduced attack surface for CVE-2026-55869, though not fully eliminated in the event of a compromised host on the same network segment.
• Endpoints restricted to known source IPs via firewall rules — effectively protected against CVE-2026-55869.

 

Description of Vulnerability CVE-2026-55868

CVE-2026-55868	Encryption State Machine Downgrade
CVSS v3.1	9.1 (Critical)
Affected Software	Open-source SRT protocol library — all versions prior to 1.5.6
Attack Vector	Network — forged control packet targeting an active encrypted session
Authentication	None — SRT control packets carry no MAC authentication
Impact	Silent encryption bypass, stream hijacking, content injection

 

Technical Description: SRT control packets carry no Message Authentication Code (MAC). An attacker who has network access to the receiver’s listening port, or who can observe an active session’s 5-tuple (source IP, source port, destination IP, destination port, SRT socket ID) and send spoofed packets to the receiver, can send a forged KMREQ control message that causes the receiver’s encryption state to transition from SECURED to BADSECRET. Once downgraded, the receiver accepts unencrypted data packets from any sender, enabling stream hijacking, content injection, and interception of live media.

What Is Affected by CVE-2026-55868

• SRT receivers processing encrypted streams — Receivers in listener mode with accessible ports are directly exploitable. Receivers in any connection mode are exploitable if the attacker can observe the session’s 5-tuple and send spoofed packets.

What Is Not Affected by CVE-2026-55868

• SRT senders and encoders
• Deployments where SRT endpoints are not accessible from untrusted networks or systems — significantly reduced attack surface for CVE-2026-55868, though not fully eliminated in the event of a compromised host on the same network segment.

Immediate Mitigation for Both Vulnerabilities

Regardless of patch status, we recommend:

1. Restrict access to SRT endpoints to known source IPs via firewall or security group rules. This eliminates the most common attack vector – unsolicited packets from untrusted sources — and takes minutes to implement.
2. Ensure SRT traffic flows over private connectivity (VPN, VPC peering, Direct Connect) rather than the public internet, particularly for encrypted sessions.
3. Avoid exposing SRT endpoints in listener mode to untrusted/public networks.
4. Monitor for unexpected SRT endpoint crashes or restarts.

Remediation

It is recommended that you take immediate remediation action by updating to SRT protocol library v1.5.6, which contains fixes for both vulnerabilities. The vulnerabilities affect all versions of the SRT protocol library prior to v1.5.6.

This update does not affect existing connections or interoperability, allowing you to take a phased approach to upgrading endpoints across your workflow.

Disclosure Credit

These vulnerabilities were reported through responsible disclosure by:

• Merbin Russel (CVE-2026-55869)
• Netflix SIRT (CVE-2026-55868)

 

We thank both parties for their responsible coordination.

Contact

For questions or assistance: director@srtalliance.org