SRT Alliance Security Advisory

Update July 24, 2026 

The following changes have been made to the SRT Alliance Security Advisory: 

• CVE-2026-55869 title corrected: “KMREQ Heap-Based Buffer Overflow” → “KMREQ/KMRSP Stack-Based Buffer Overflow” 

• CVE-2026-55869 technical description corrected: Vulnerability reclassified from heap-based to stack-based buffer overflow; KMRSP packet processing added to affected scope alongside KMREQ 

• GitHub Advisory GHSA-6xg9-784j-24rm updated: Title and Impact section revised to reflect the stack-based classification and KMRSP inclusion 

• CVE notification process: Updated CVE-2026-55869 description submitted to CVE Numbering Authority to reflect corrected vulnerability type and affected packet handlers 

 These corrections have been applied to: 

• This SRT Alliance Security Advisory page 

• GitHub Security Advisory GHSA-6xg9-784j-24rm 

• The pending CVE-2026-55869 record (awaiting publication) 
  
  

Overview

Two critical security vulnerabilities (CVSS 9.1) have been identified and patched in the open-source SRT protocol library. Two CVEs have been published for these vulnerabilities.

• CVE-2026-55869: Stack-Based Buffer Overflow in KMREQ/KMRSP Handling
• CVE-2026-55868: Encryption State Machine Downgrade

Note: The CVE records (CVE-2026-55869 and CVE-2026-55868) are currently “reserved” and pending publication by the CVE Numbering Authority. Due to high volume across the industry, publication is expected within approximately three weeks. The full vulnerability details, CVSS scores, and remediation guidance on this page are complete and accurate — the published CVE records will contain the same information. Once published, organizations using automated vulnerability monitoring tools will be notified through their standard scanning workflows.

Recommended Action

It is recommended that you take immediate remediation action by updating to SRT protocol library v1.5.6, which contains fixes for both vulnerabilities.

The vulnerabilities affect all versions of the SRT protocol library prior to v1.5.6.

Description of Vulnerability CVE-2026-55869

Technical Description: A stack-based buffer overflow exists in the SRT protocol library when processing KMREQ and KMRSP control packets during connection setup and key refresh operations. A remote attacker can send a specially crafted packet that causes the SRT process to crash. No valid credentials, passphrase, or completed handshake are required.

What Is Affected by CVE-2026-55869

• All SRT endpoints (senders and receivers) in any connection mode — Endpoints with listening ports accessible from untrusted networks are at highest risk. Endpoints in any mode are vulnerable if the attacker can observe the session’s 5-tuple.

What Is Not Affected by CVE-2026-55869

• Deployments where SRT endpoints are not accessible from untrusted networks or systems – significantly reduced attack surface for CVE-2026-55869, though not fully eliminated in the event of a compromised host on the same network segment.
• Endpoints restricted to known source IPs via firewall rules — effectively protected against CVE-2026-55869.

Description of Vulnerability CVE-2026-55868

Technical Description: SRT control packets carry no Message Authentication Code (MAC). An attacker who has network access to the receiver’s listening port, or who can observe an active session’s 5-tuple (source IP, source port, destination IP, destination port, SRT socket ID) and send spoofed packets to the receiver, can send a forged KMREQ control message that causes the receiver’s encryption state to transition from SECURED to BADSECRET. Once downgraded, the receiver accepts unencrypted data packets from any sender, enabling stream hijacking, content injection, and interception of live media.

What Is Affected by CVE-2026-55868

• SRT receivers processing encrypted streams — Receivers in listener mode with accessible ports are directly exploitable. Receivers in any connection mode are exploitable if the attacker can observe the session’s 5-tuple and send spoofed packets.

What Is Not Affected by CVE-2026-55868

• SRT senders and encoders
• Deployments where SRT endpoints are not accessible from untrusted networks or systems — significantly reduced attack surface for CVE-2026-55868, though not fully eliminated in the event of a compromised host on the same network segment.

Immediate Mitigation for Both Vulnerabilities

Regardless of patch status, we recommend:

1. Restrict access to SRT endpoints to known source IPs via firewall or security group rules. This eliminates the most common attack vector – unsolicited packets from untrusted sources — and takes minutes to implement.
2. Ensure SRT traffic flows over private connectivity (VPN, VPC peering, Direct Connect) rather than the public internet, particularly for encrypted sessions.
3. Avoid exposing SRT endpoints in listener mode to untrusted/public networks.
4. Monitor for unexpected SRT endpoint crashes or restarts.

Remediation

It is recommended that you take immediate remediation action by updating to SRT protocol library v1.5.6, which contains fixes for both vulnerabilities. The vulnerabilities affect all versions of the SRT protocol library prior to v1.5.6.

This update does not affect existing connections or interoperability, allowing you to take a phased approach to upgrading endpoints across your workflow.

Disclosure Credit

These vulnerabilities were reported through responsible disclosure by:

• Merbin Russel (CVE-2026-55869)
• Netflix SIRT (CVE-2026-55868)

We thank both parties for their responsible coordination.

Contact

For questions or assistance: director@srtalliance.org