webrtc project vulnerabilities

Products

• webrtc 4

Latest webrtc project CVEs

Newest publication first

1. CVE-2022-2294 Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

   Published 2022-07-28

   High·CVSS 8.8 EPSS 70.8% CISA KEV added 2022-08-25 Ransomware Exploited in the wild

   Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

2. CVE-2021-28681 In github.com/pion/webrtc, failed DTLS certificate verification doesn't stop data channel communication

   Published 2021-03-18

   Medium·CVSS 5.3 EPSS 0.68%

   Pion WebRTC before 3.0.15 didn't properly tear down the DTLS Connection when certificate verification failed. The PeerConnectionState was set to failed, but a user could ignore that and continue to use the PeerConnection. )A WebRTC implementation shouldn't allow the user to conti...

3. CVE-2016-1976 Use-after-free vulnerability in the DesktopDisplayDevice class in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service or possi...

   Published 2016-03-13

   Medium·CVSS 5.5 EPSS 1.3%

   Use-after-free vulnerability in the DesktopDisplayDevice class in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

4. CVE-2016-1975 Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (...

   Published 2016-03-13

   Medium·CVSS 6.3 EPSS 1.2%

   Multiple race conditions in dom/media/systemservices/CamerasChild.cpp in the WebRTC implementation in Mozilla Firefox before 45.0 on Windows might allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.