Medium
RTSP RTP buffer over-read
Type: advisorySources: OSV
curl can be tricked into copying data beyond end of its heap based buffer. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The `memcpy()` call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it did not cause a crash). We have managed to get it to reach several hundreds bytes out of range. This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2018-1000122
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:37 UTC · Revision 1
Source evidence
curl can be tricked into copying data beyond end of its heap based buffer. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The `memcpy()` call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it did not cause a crash). We have managed to get it to reach several hundreds bytes out of range. This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this.
osv:CURL-CVE-2018-1000122
Complete source record
{
"id": "abdfbcf7f3c84669929fce390f88a6b1d144d883aeb222056db7556832fb0424",
"url": "https://osv.dev/vulnerability/CURL-CVE-2018-1000122",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "RTSP RTP buffer over-read",
"summary": "curl can be tricked into copying data beyond end of its heap based buffer. When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The `memcpy()` call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it did not cause a crash). We have managed to get it to reach several hundreds bytes out of range. This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this.",
"evidence": "osv:CURL-CVE-2018-1000122",
"products": [],
"severity": "medium",
"structured": {
"id": "CURL-CVE-2018-1000122",
"aliases": [
"CURL-CVE-2018-1000122",
"CVE-2018-1000122"
],
"affected": [
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "7.20.0"
},
{
"fixed": "7.59.0"
}
]
},
{
"repo": "https://github.com/curl/curl.git",
"type": "GIT",
"events": [
{
"introduced": "bc4582b68a673d3b0f5a2e7d971605de2c8b3730"
},
{
"fixed": "d52dc4760f6d9ca1937eefa2093058a952465128"
}
]
}
],
"versions": [
"7.58.0",
"7.57.0",
"7.56.1",
"7.56.0",
"7.55.1",
"7.55.0",
"7.54.1",
"7.54.0",
"7.53.1",
"7.53.0",
"7.52.1",
"7.52.0",
"7.51.0",
"7.50.3",
"7.50.2",
"7.50.1",
"7.50.0",
"7.49.1",
"7.49.0",
"7.48.0",
"7.47.1",
"7.47.0",
"7.46.0",
"7.45.0",
"7.44.0",
"7.43.0",
"7.42.1",
"7.42.0",
"7.41.0",
"7.40.0",
"7.39.0",
"7.38.0",
"7.37.1",
"7.37.0",
"7.36.0",
"7.35.0",
"7.34.0",
"7.33.0",
"7.32.0",
"7.31.0",
"7.30.0",
"7.29.0",
"7.28.1",
"7.28.0",
"7.27.0",
"7.26.0",
"7.25.0",
"7.24.0",
"7.23.1",
"7.23.0",
"7.22.0",
"7.21.7",
"7.21.6",
"7.21.5",
"7.21.4",
"7.21.3",
"7.21.2",
"7.21.1",
"7.21.0",
"7.20.1",
"7.20.0",
"curl-7_58_0",
"curl-7_57_0",
"curl-7_56_1",
"curl-7_56_0",
"curl-7_55_1",
"curl-7_55_0",
"curl-7_54_1",
"curl-7_54_0",
"curl-7_53_1",
"curl-7_53_0",
"curl-7_52_1",
"curl-7_52_0",
"curl-7_51_0",
"curl-7_50_3",
"curl-7_50_2",
"curl-7_50_1",
"curl-7_50_0",
"curl-7_49_1",
"curl-7_49_0",
"curl-7_48_0",
"curl-7_47_1",
"curl-7_47_0",
"curl-7_46_0",
"curl-7_45_0",
"curl-7_44_0",
"curl-7_43_0",
"curl-7_42_1",
"curl-7_42_0",
"curl-7_41_0",
"curl-7_40_0",
"curl-7_39_0",
"curl-7_38_0",
"curl-7_37_1",
"curl-7_37_0",
"curl-7_36_0",
"curl-7_35_0",
"curl-7_34_0",
"curl-7_33_0",
"curl-7_32_0",
"curl-7_31_0",
"curl-7_30_0",
"curl-7_29_0",
"curl-7_28_1",
"curl-7_28_0",
"curl-7_27_0",
"curl-7_26_0",
"curl-7_25_0",
"curl-7_24_0",
"curl-7_23_1",
"curl-7_23_0",
"curl-7_22_0",
"curl-7_21_7",
"curl-7_21_6",
"curl-7_21_5",
"curl-7_21_4",
"curl-7_21_3",
"curl-7_21_2",
"curl-7_21_1",
"curl-7_21_0",
"curl-7_20_1",
"curl-7_20_0"
],
"database_specific": {
"source": "https://curl.se/docs/CURL-CVE-2018-1000122.json",
"vanir_signatures": [
{
"id": "CURL-CVE-2018-1000122-b3abb50e",
"digest": {
"length": 7977,
"function_hash": "161498815877371629434851987410308038878"
},
"source": "https://github.com/curl/curl.git/commit/d52dc4760f6d9ca1937eefa2093058a952465128",
"target": {
"file": "lib/transfer.c",
"function": "readwrite_data"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CURL-CVE-2018-1000122-c8b5f2ef",
"digest": {
"threshold": 0.9,
"line_hashes": [
"225307090206503833151540635093094317452",
"290229519799572691106036723336395442631",
"37104245460420581268215469924813140376",
"180905971171888284277329229387145828511",
"163226654129534360720460174640381834241",
"264452607322690180977503567287561379955"
]
},
"source": "https://github.com/curl/curl.git/commit/d52dc4760f6d9ca1937eefa2093058a952465128",
"target": {
"file": "lib/transfer.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-25T01:04:54Z"
}
}
],
"modified": "2026-10-25T01:04:54.415628771Z",
"provider": "osv",
"references": [],
"provider_metadata": {
"CWE": {
"id": "CWE-126",
"desc": "Buffer Over-read"
},
"URL": "https://curl.se/docs/CVE-2018-1000122.json",
"www": "https://curl.se/docs/CVE-2018-1000122.html",
"affects": "both",
"package": "curl",
"severity": "Medium",
"last_affected": "7.58.0"
}
},
"related_cves": [
{
"value": "CVE-2018-1000122",
"evidence": "/aliases"
}
],
"security_relevant": true,
"severity_evidence": "/database_specific/severity"
},
"source_id": "core-osv",
"document_id": 444306,
"published_at": "2018-03-14T08:00:00+00:00"
}