CVE-2025-60458: 
NixOS vulnerability analysis and mitigation

CVE-2025-60458 is a double free vulnerability in UxPlay version 1.72 affecting its RTSP request handling logic. A remote attacker can send a specially crafted RTSP TEARDOWN request to trigger multiple calls to free() on the same heap memory address, potentially causing a Denial of Service (application crash). The vulnerability was disclosed on December 29, 2025, and affects only UxPlay version 1.72 by antimof. It carries a CVSS v3.1 base score of 6.5 (Medium), assigned by CISA-ADP (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-415 (Double Free) and CWE-400 (Uncontrolled Resource Consumption), rooted in improper memory lifecycle management during RTSP session cleanup in UxPlay 1.72. When a specially crafted RTSP TEARDOWN request is processed, the session teardown logic fails to properly track memory ownership, resulting in free() being called multiple times on the same heap object, causing heap corruption. The attack vector is network-based and requires user interaction (UI:R per CVSS), meaning the target must be running an active UxPlay session. A public proof-of-concept repository including a Python exploit script (poc.py) has been published by researcher Jbr Alotaibi (GitHub PoC).

Successful exploitation results in heap corruption leading to an application crash, causing a Denial of Service condition for users of the affected UxPlay instance. There is no evidence of confidentiality or integrity impact — the vulnerability is limited to availability. Because UxPlay functions as an AirPlay receiver, exploitation could disrupt media streaming services on affected Linux systems, but lateral movement or data exfiltration are not associated with this vulnerability (Red Hat Advisory, GitHub PoC).

A public proof-of-concept exploit (Python script) is available on GitHub, published by the discoverer shortly after disclosure (GitHub PoC). There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.034% (0.000340), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus detection plugin 280131 is available for identifying vulnerable systems (Tenable).

1. Reconnaissance: Identify systems running UxPlay 1.72 that are accessible over the network, typically listening on RTSP port 7100 (or configured port). Tools like Nmap can be used to discover open RTSP services.
2. Establish RTSP session: Initiate a valid RTSP session with the target UxPlay instance to establish a session context (e.g., via an RTSP ANNOUNCE or SETUP request).
3. Craft malicious TEARDOWN request: Construct a specially crafted RTSP TEARDOWN request that manipulates session state to trigger the double free condition in the session cleanup logic. The public PoC (poc.py) automates this step.
4. Trigger double free: Send the crafted TEARDOWN request to the target. The vulnerable code calls free() multiple times on the same heap memory address during session teardown.
5. Achieve DoS: The heap corruption causes UxPlay to crash, resulting in a Denial of Service for all connected clients (GitHub PoC).

• Network: Unexpected or malformed RTSP TEARDOWN requests targeting the UxPlay RTSP port (default 7100); repeated RTSP session establishment and teardown sequences from a single source IP in a short timeframe.
• Logs: Application crash logs or core dumps from the UxPlay process; system logs (e.g., syslog, journalctl) showing segmentation faults or heap corruption errors associated with the UxPlay process.
• Process: Sudden termination of the uxplay process without user-initiated shutdown; repeated restarts of the UxPlay service if configured with auto-restart.

Users should upgrade UxPlay to version 1.73.3 or later, which addresses this vulnerability, as referenced by Fedora security updates (Linux Compatible). As interim mitigations: restrict network access to the UxPlay RTSP port using firewall rules to trusted clients only; monitor RTSP traffic for anomalous TEARDOWN request patterns; and consider disabling UxPlay when not in active use. Red Hat has tracked this issue and Fedora 42 received an updated package (uxplay-1.73.3) addressing this CVE (Red Hat Bugzilla, Fedora Update).

Red Hat's Product Security team tracked the vulnerability via Bugzilla and classified it as high severity/priority, with dependent tracking bugs filed for affected Fedora and RHEL packages (Red Hat Bugzilla). A technical write-up was published by Infinit Security shortly after disclosure (Infinit Security). Community reaction has been limited given the moderate severity and narrow scope of the affected software.