CVE-2020-24027

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug...

9.8 CriticalFix available

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.63%Up 1.0 points since Apr 14, 2021

What each source reports

NVD Score used 9.8

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.

Record: CVE-2020-24027
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-787
Updated: 2026-11-02

CVE List No score

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.

Record: CVE-2020-24027
Updated: 2026-11-02

EUVDEUVD-2020-16763 No score

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.

Record: EUVD-2020-16763
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hq96-75hc-q3ww No score

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug...

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.

Record: GHSA-hq96-75hc-q3ww
Weakness: CWE-787
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-24027 9.8

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.

Record: DEBIAN-CVE-2020-24027
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-24027 9.8

In Live Networks, Inc., liblivemedia version 20200625, there is a potential buffer overflow bug in the server handling of a RTSP "PLAY" command, when the command specifies seeking by absolute time.

Record: UBUNTU-CVE-2020-24027
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

live555 liblivemedia

Affected packages

Affected packages
Package	Affected	Fixed
`liblivemedia` Debian:14	before 2026.09.23-dfsg-1, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 45 moreShow less 2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-12014.01.13-12015.12.22-12016.01.12-12016.01.16-12016.01.20-12016.01.29-12016.01.29-2	2026.09.23-dfsg-1
`liblivemedia` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 2014.01.13-12016.01.29-22016.02.09-12016.02.09-1ubuntu0.1~esm1	None known
`liblivemedia` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2017.07.18-12017.09.12-1ubuntu12017.10.28-22018.01.29-12018.02.18-12018.02.18-1ubuntu0.1~esm1	None known
`liblivemedia` Ubuntu:20.04:LTS	All versions, plus listed versions 2018.11.26-1.12020.01.19-12020.01.19-1build1	None known
`liblivemedia` Ubuntu:26.10	All versions, plus listed versions 2026.09.23-dfsg-12026.09.23-dfsg-32026.09.23-dfsg-4	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-24027 is a critical vulnerability (CVSS 9.8) in Live555 Liblivemedia, published January 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in liblivemedia 2026.09.23-dfsg-1.

References

This page doesn't list everything

Left out here: 52 versions. The JSON record has them.