2027499 - (CVE-2026-6752) Heap buffer overflow in RtpPacket::SetCsrcs — missing upstream security fix

Status: RESOLVED FIXED

(Core :: WebRTC, defect)

Description

[jmwebdevelopement]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36

Steps to reproduce:

Manual source code review of third_party/libwebrtc/modules/rtp_rtcp/source/rtp_packet.cc identified that RtpPacket::SetCsrcs() (lines 227-241) performs heap buffer writes with only RTC_DCHECK bounds checking — compiled out in release builds. Firefox's libwebrtc was last synced 2026-03-24, missing upstream Chromium security fix commit 5560f13 (chromium:486317116) authored 2026-03-25.

Actual results:

SetCsrcs() writes attacker-controlled uint32_t CSRC values past the heap buffer boundary via WriteAt() BEFORE SetSize() resizes the buffer. All 5 guard conditions are RTC_DCHECK (no-ops in release Firefox). A malicious WebRTC peer can deliver crafted RTP packets with >15 CSRCs, causing heap buffer overflow with attacker-controlled content. Adjacent heap objects include SRTP contexts and audio frame buffers.

Expected results:

SetCsrcs() should perform runtime bounds checking (RTC_CHECK, not RTC_DCHECK) and resize the buffer BEFORE writing. The upstream fix (commit 5560f13) adds runtime truncation and resize-before-write ordering. Firefox should import this fix.

Comment 1

[Daniel Veditz [:dveditz]]

We have a consistent record of updating this library:
https://bugzilla.mozilla.org/buglist.cgi?v1=update%20libwebrtc%20to%20&o1=substring&f1=short_desc

This is not included on Chrome's "security notify" list yet which means it could in theory change or require follow-up fixes before they release it.
https://webrtc-review.googlesource.com/c/src/+/459943

Comment 2

[Daniel Veditz [:dveditz]]

I don't know if this vulnerability can be triggered in Firefox, or how serious a security vulnerability this is for Chrome, but it is an inaccessible Chrome bug and does presumably affect Firefox since we have coverage data for this file. Guessing "sec-high" because it's a bounds issue

Comment 3

[Michael Froman [:mjf]]

Attachment: (secure)

Comment 4

[Michael Froman [:mjf]]

Byron,

This may have to wait until Wed - it appears to require taking parts of the following upstream commits:
5560f130af Truncate CSRC list in RtpPacket::SetCsrcs if too large
359fa9ef4f Replace ArrayView with std::span in modules/rtp_rtcp
b4ba35203b Restrict ArrayView constructor from genertic range
c445a96208 Deprecate conversion from nullptr to an empty ArrayView

Taking just 5560f130af does not compile. I might get a chance to look combining what we need into a single commit.

Comment 5

[Michael Froman [:mjf]]

I'm working this patch set now.

Comment 6

[Michael Froman [:mjf]]

Attachment: (secure)

Comment 7

[Michael Froman [:mjf]]

This was easier than the patch-stack made it look - it only required a small change on top of the upstream commit 5560f130af.

Comment 8

[Michael Froman [:mjf]]

Comment on attachment 9563358 [details]
(secure)

Security Approval Request

• How easily could an exploit be constructed based on the patch?: If someone is really paying close attention they might figure out that they could create a malicious peer.
• Do comments in the patch, the check-in comment, or tests included in the patch paint a bulls-eye on the security problem?: No
• Which branches (beta, release, and/or ESR) are affected by this flaw, and do the release status flags reflect this affected/unaffected state correctly?: all
• If not all supported branches, which bug introduced the flaw?: Bug 1341285
• Do you have backports for the affected branches?: No
• If not, how different, hard to create, and risky will they be?: Not difficult.
• How likely is this patch to cause regressions; how much testing does it need?: Not likely.
• Is the patch ready to land after security approval is given?: Yes
• Is Android affected?: Yes

Comment 9

[Tom Ritter [:tjr]]

Comment on attachment 9563358 [details]
(secure)

Approved to land and request uplift

Comment 10

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/becff80db207
https://hg.mozilla.org/integration/autoland/rev/ccdaaef4f2b1
adhere to spec on number of CSRCs in rtp packets. r=bwc

Comment 11

[Ryan VanderMeulen [:RyanVM]]

https://hg-edge.mozilla.org/mozilla-central/rev/ccdaaef4f2b1

Comment 12

[BugBot [:suhaib / :marco]]

The patch landed in nightly and beta is affected.
:mjf, is this bug important enough to require an uplift?

• If yes, please nominate the patch for beta approval.
  • See https://wiki.mozilla.org/Release_Management/Requesting_an_Uplift for documentation on how to request an uplift.
• If no, please set status-firefox150 to wontfix.

For more information, please visit BugBot documentation.

Comment 13

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: A malicious WebRTC peer could deliver crafted RTP packets with >15 CSRCs, causing heap buffer overflow with attacker-controlled content. Adjacent heap objects include SRTP contexts and audio frame buffers.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: This is a small change in code that has been static since 2017.
• String changes made/needed?: n/a
• Is Android affected?: yes

Comment 14

[Michael Froman [:mjf]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D291629

Comment 15

[Michael Froman [:mjf]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D291629

Comment 16

[Phabricator Automation]

firefox-esr140 Uplift Approval Request

• User impact if declined/Reason for urgency: A malicious WebRTC peer could deliver crafted RTP packets with >15 CSRCs, causing heap buffer overflow with attacker-controlled content. Adjacent heap objects include SRTP contexts and audio frame buffers.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: This is a small change in code that has been static since 2017.
• String changes made/needed?: n/a
• Is Android affected?: yes

Comment 17

[Michael Froman [:mjf]]

Attachment: (secure)

Original Revision: https://phabricator.services.mozilla.com/D291629

Comment 18

[Phabricator Automation]

firefox-esr115 Uplift Approval Request

• User impact if declined/Reason for urgency: A malicious WebRTC peer could deliver crafted RTP packets with >15 CSRCs, causing heap buffer overflow with attacker-controlled content. Adjacent heap objects include SRTP contexts and audio frame buffers.
• Code covered by automated testing?: yes
• Fix verified in Nightly?: no
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: This is a small change in code that has been static since 2017.
• String changes made/needed?: n/a
• Is Android affected?: yes

Comment 19

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/d7030a60ba3b
https://hg.mozilla.org/releases/mozilla-beta/rev/88ab2d9c0b1e

Comment 20

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/06429b23205b

Comment 21

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr140/rev/f2c95cabb7db

Comment 22

[Pulsebot]

https://hg.mozilla.org/releases/mozilla-esr115/rev/05f58effd012