AIKIDO-2026-407703
libwebrtc is vulnerable to Information Disclosure
55
Medium Risk
This Affects:
libwebrtcTL;DR
Affected versions of libwebrtc leak uninitialized heap memory through NativeVideoSource pre-capture keepalive frames. webrtc::I420Buffer::Create allocates pixel planes without initializing them, and until the first real capture_frame the source publishes that buffer every 100ms. Subscribers can therefore receive recycled process heap contents — often fragments of earlier video frames — decoded as the first keyframes. The fix introduces I420Buffer::new_black (SetBlack) and uses it for the keepalive buffer only.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and publish video via NativeVideoSource on native (non-Wasm) targets, so pre-capture keepalive frames can reach remote subscribers before the first captured frame.
Background info
libwebrtc is vulnerable to Information Disclosure in versions 0.3.0 - 0.3.42.
How to fix this
Upgrade the libwebrtc library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.