CVE-2026-116568 · Runtime
NO FIX YET · SEE WHAT TO DO
FreeSWITCH before 1.11.2 mishandles oversized H.264 NAL unit length prefixes in its mod_rtmp video path, causing an out-of-bounds read. A remote client can crash FreeSWITCH and terminate every active call, though no code execution has been demonstrated.
first public Oct 26, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Deployments that build and load mod_rtmp and accept RTMP video call sessions, commonly on TCP port 1935. Placing a call requires a directory login when auth-calls is true; with auth-calls absent or false, no credentials are needed. Deployments without mod_rtmp loaded, or not accepting RTMP, are not exposed.
Not affected if auth-calls-true, mod-rtmp-not-loaded, no-rtmp-listener
Who cares freeswitch, rtmp, self-hosted, telephony
fs_cli -x version and compare against 1.11.2.fs_cli -x "module_exists mod_rtmp".auth-calls is set to true in the RTMP configuration; if it is absent or false, no credentials are needed.1.11.2.FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.