CVE-2026-116567 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeSWITCH before 1.11.2 copies an RTMP user-control message into a fixed 200-byte stack buffer without a length limit, so a body of about 70 bytes or more overflows the stack. An attacker who can reach the RTMP listener without logging in can crash FreeSWITCH and drop every active call.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments that build and load mod_rtmp are exposed, since it is disabled in the stock build and configuration. Exposure is highest where the RTMP listener on TCP port 1935 is reachable from untrusted networks, because the handshake does not authenticate either side. Systems without mod_rtmp, or with port 1935 blocked from untrusted networks, can skip it.
Not affected if default-config, mod-rtmp-not-loaded, port-1935-filtered
Who cares freeswitch, telephony, voip
fs_cli -x version or freeswitch -version; anything below 1.11.2 is affected.fs_cli -x "module_exists mod_rtmp" or by looking for mod_rtmp in the modules.conf file.1.11.2 or later.FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A body of roughly 70 bytes or more overflowed the stack before any RTMP login, because the handshake authenticates neither side. The flaw affects deployments that build and load mod_rtmp, which is disabled in the stock build and configuration but commonly exposes a listener on TCP port 1935 when enabled. One unauthenticated message can crash FreeSWITCH and end every active call; the constrained ASCII hex output has not yielded control-flow hijacking. This issue is fixed in version 1.11.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.