CVE-2026-116567: FreeSWITCH: Pre-authentication stack buffer overflow in mod_rtmp control-message handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmphandlecontrol() rendered an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A body of roughly 70 bytes or more overflowed the stack before any RTMP login, because the handshake authenticates neither side. The flaw affects deployments that build and load modrtmp, which is disabled in the stock build and configuration but commonly exposes a listener on TCP port 1935 when enabled. One unauthenticated message can crash FreeSWITCH and end every active call; the constrained ASCII hex output has not yielded control-flow hijacking. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Are default FreeSWITCH installations exposed?
No. The issue affects deployments that build and load mod_rtmp; the module is disabled in the stock build and configuration. When enabled, it commonly exposes an RTMP listener on TCP port 1935.
Does an attacker need credentials or an established RTMP session?
No. The overflow can be triggered before RTMP login because the handshake authenticates neither side. A single crafted RTMP user-control message with a body of roughly 70 bytes or more can crash the service.
What is the practical impact of exploitation?
The documented impact is denial of service: crashing FreeSWITCH ends every active call. The constrained ASCII-hex output has not yielded control-flow hijacking.
How can I determine whether a deployment is affected?
Check whether mod_rtmp was built and is loaded, and whether it is listening for RTMP connections, commonly on TCP port 1935. Versions prior to 1.11.2 with mod_rtmp enabled are affected.
What can be done if upgrading is not immediately possible?
Disable or unload mod_rtmp if it is not required. If the module must remain enabled, restrict access to its RTMP listener so untrusted networks cannot send control messages to it.