CVE-2026-116782: FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmpiconnect() passed the first RTMP connect argument to amf0objectget() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled modrtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Only FreeSWITCH deployments with a mod_rtmp listener enabled are exposed. The module is disabled in the stock build and configuration, so default installations are not affected unless mod_rtmp has been enabled.
Does an attacker need credentials or an active session?
No. Any client that can reach an enabled mod_rtmp listener can send a malformed RTMP connect command before login; no authentication or user interaction is required.
What is the practical impact of successful exploitation?
The malformed command reliably crashes FreeSWITCH and terminates every active call. The available information does not demonstrate a write primitive, memory disclosure, or code execution.
What should be done if upgrading cannot happen immediately?
Disable mod_rtmp or prevent untrusted network clients from reaching its listener. This removes the network path required to send the malformed pre-authentication connect command.
How can I determine whether remediation is needed?
Check whether mod_rtmp is enabled and listening for RTMP connections, and identify the installed FreeSWITCH version. Versions prior to 1.11.2 with an enabled listener require remediation.