Vulnerability · Published Jan 27, 2026 · Assigned by GovTech CSG

CVE-2026-1465A heap-based buffer over-read or buffer overflow in tildearrow/furnace

High 8.7

In plain English

A high-severity memory corruption in anyRTC-RTMP-OpenSource from anyrtcIO-Community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.1%top 96.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in anyrtcIO-Community anyRTC-RTMP-OpenSource (third_party/faad2-2.7/libfaad modules). This vulnerability is associated with program files bits.C, syntax.C. This issue affects anyRTC-RTMP-OpenSource: before 1.0.

Affected products (as reported)

Vendor	Product	Versions
anyrtcIO-Community	anyRTC-RTMP-OpenSource	0 – before 1.0

Weakness: CWE-119 · Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:N/AU:Y/R:U/V:D/RE:L/U:Amber

References

https://github.com/anyrtcIO-Community/anyRTC-RTMP-OpenSource/pull/166 patch