CVE-2026-116568: FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmprtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load modrtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are affected if they build and load mod_rtmp and accept video call sessions, commonly through TCP port 1935. Systems not using mod_rtmp for video sessions are not identified as affected by the available information.
Does an attacker need an account to trigger the crash?
It depends on the directory configuration. A caller needs a directory login when auth-calls is true; no credentials are required when auth-calls is absent or false.
What is the practical impact of successful exploitation?
A remote client can terminate the FreeSWITCH process and every active call. The available information does not indicate a write primitive or demonstrated memory disclosure.
How can this be remediated?
Update FreeSWITCH to version 1.11.2, which fixes the issue.