{"id":"CVE-2026-116567","kind":"vulnerability","aliases":["CVE-2026-116567"],"related":[],"title":"FreeSWITCH: unauthenticated RTMP message overflows stack, crashes telephony server","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A body of roughly 70 bytes or more overflowed the stack before any RTMP login, because the handshake authenticates neither side. The flaw affects deployments that build and load mod_rtmp, which is disabled in the stock build and configuration but commonly exposes a listener on TCP port 1935 when enabled. One unauthenticated message can crash FreeSWITCH and end every active call; the constrained ASCII hex output has not yielded control-flow hijacking. This issue is fixed in version 1.11.2.","summary":"FreeSWITCH before 1.11.2 copies an RTMP user-control message into a fixed 200-byte stack buffer without a length limit, so a body of about 70 bytes or more overflows the stack. An attacker who can reach the RTMP listener without logging in can crash FreeSWITCH and drop every active call.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","runtime","telephony","voip"],"not_affected_if":["default-config","mod-rtmp-not-loaded","port-1935-filtered"],"how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` or `freeswitch -version`; anything below `1.11.2` is affected.\n- Check whether mod_rtmp is loaded with `fs_cli -x \"module_exists mod_rtmp\"` or by looking for mod_rtmp in the modules.conf file.\n- If mod_rtmp is loaded, check whether TCP port 1935 is listening and reachable from outside the host.","fix":"- Upgrade FreeSWITCH to `1.11.2` or later.","status":"open","published_at":"2026-11-05T20:17:43+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","triaged_at":"2026-11-05T20:43:09+00:00","updated_at":"2026-11-05T20:43:09+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T20:43:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FreeSWITCH to `1.11.2` or later.","reach":"network","title":"FreeSWITCH: unauthenticated RTMP message overflows stack, crashes telephony server","impact":"medium","summary":"FreeSWITCH before 1.11.2 copies an RTMP user-control message into a fixed 200-byte stack buffer without a length limit, so a body of about 70 bytes or more overflows the stack. An attacker who can reach the RTMP listener without logging in can crash FreeSWITCH and drop every active call.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","telephony","voip"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated crash of FreeSWITCH, ending all active calls","analyst_note":"","how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` or `freeswitch -version`; anything below `1.11.2` is affected.\n- Check whether mod_rtmp is loaded with `fs_cli -x \"module_exists mod_rtmp\"` or by looking for mod_rtmp in the modules.conf file.\n- If mod_rtmp is loaded, check whether TCP port 1935 is listening and reachable from outside the host.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","mod-rtmp-not-loaded","port-1935-filtered"],"who_is_affected":"Only deployments that build and load mod_rtmp are exposed, since it is disabled in the stock build and configuration. Exposure is highest where the RTMP listener on TCP port 1935 is reachable from untrusted networks, because the handshake does not authenticate either side. Systems without mod_rtmp, or with port 1935 blocked from untrusted networks, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000787,"input_tokens":4464,"output_tokens":682,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116567':12A,15A '-2026':11A,14A '1.11.2':22B,99C,207C '1935':175C '200':33B,112C '70':46B,131C 'activ':70B,187C 'affect':150C 'ascii':191C 'attack':54B 'authent':145C 'bodi':43B,128C 'buffer':36B,115C 'build':153C,164C 'byte':34B,47B,113C,132C 'call':71B,188C 'commod':95C 'common':168C 'configur':166C 'constrain':190C 'control':28B,102C,108C,121C,198C 'control-flow':197C 'copi':23B 'crash':7A,65B,182C 'cve':10A,13A 'defin':76C 'deploy':151C 'digit':81C 'disabl':160C 'drop':68B 'enabl':79C,177C 'end':185C 'everi':69B,186C 'expos':169C 'fix':32B,204C 'flaw':149C 'flow':199C 'freeswitch':1A,16B,20B,66B,72C,183C 'handl':101C 'handshak':144C 'hardwar':96C 'hex':192C 'hijack':200C 'implement':90C 'issu':202C 'length':39B,126C 'limit':40B 'listen':60B,171C 'load':155C 'log':62B 'login':141C 'loop':120C 'messag':4A,29B,109C,125C,180C 'mod':156C 'neither':146C 'one':178C 'output':193C 'overflow':5A,50B,135C 'port':174C 'prior':97C 'proprietari':84C 'reach':57B 'render':103C 'rough':130C 'rtmp':3A,25B,59B,100C,105C,140C,157C 'run':92C 'runtim':17B 'server':9A 'side':147C 'softwar':75C,89C 'sprintf':119C 'stack':6A,35B,52B,78C,114C,137C 'stock':163C 'switch':86C 'tcp':173C 'telecom':77C,85C 'telephoni':8A,18B 'transform':82C 'unauthent':2A,179C 'unbound':118C 'use':116C 'user':27B,107C 'user-control':26B,106C 'version':206C 'voip':19B 'wire':124C 'without':37B,61B 'yield':196C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that build and load mod_rtmp are exposed, since it is disabled in the stock build and configuration. Exposure is highest where the RTMP listener on TCP port 1935 is reachable from untrusted networks, because the handshake does not authenticate either side. Systems without mod_rtmp, or with port 1935 blocked from untrusted networks, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","high","runtime","telephony","voip"],"campaign_type":null,"first_public_at":"2026-10-26T21:11:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116567","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116567","severity":null,"published_at":"2026-11-05T20:17:43+00:00","modified_at":"2026-11-05T20:17:43+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","fetched_at":"2026-11-05T20:40:44+00:00","note":null}],"documents":[{"id":79840,"url":"https://github.com/signalwire/freeswitch/commit/fc0db829b87d1a5a3043e355b4294c41851b13c6","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79842,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-hj6x-9653-p796","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T21:11:20+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}