{"id":"CVE-2026-116568","kind":"vulnerability","aliases":["CVE-2026-116568"],"related":[],"title":"FreeSWITCH: crafted RTMP video packet crashes the process and all calls","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.","summary":"FreeSWITCH before 1.11.2 mishandles oversized H.264 NAL unit length prefixes in its mod_rtmp video path, causing an out-of-bounds read. A remote client can crash FreeSWITCH and terminate every active call, though no code execution has been demonstrated.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","rtmp","runtime","self-hosted","telephony"],"not_affected_if":["auth-calls-true","mod-rtmp-not-loaded","no-rtmp-listener"],"how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and compare against `1.11.2`.\n- Check whether mod_rtmp is loaded with `fs_cli -x \"module_exists mod_rtmp\"`.\n- Check whether `auth-calls` is set to true in the RTMP configuration; if it is absent or false, no credentials are needed.","fix":"- FreeSWITCH: upgrade to `1.11.2`.","status":"open","published_at":"2026-11-05T20:17:43+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","triaged_at":"2026-11-05T20:43:09+00:00","updated_at":"2026-11-05T20:43:09+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-05T20:43:09Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: upgrade to `1.11.2`.","reach":"internet","title":"FreeSWITCH: crafted RTMP video packet crashes the process and all calls","impact":"medium","summary":"FreeSWITCH before 1.11.2 mishandles oversized H.264 NAL unit length prefixes in its mod_rtmp video path, causing an out-of-bounds read. A remote client can crash FreeSWITCH and terminate every active call, though no code execution has been demonstrated.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","telephony","rtmp","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"remote client crashes FreeSWITCH and drops all active calls","analyst_note":"","how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and compare against `1.11.2`.\n- Check whether mod_rtmp is loaded with `fs_cli -x \"module_exists mod_rtmp\"`.\n- Check whether `auth-calls` is set to true in the RTMP configuration; if it is absent or false, no credentials are needed.","plain_action":"","needs_analyst":false,"not_affected_if":["mod-rtmp-not-loaded","auth-calls-true","no-rtmp-listener"],"who_is_affected":"Deployments that build and load mod_rtmp and accept RTMP video call sessions, commonly on TCP port 1935. Placing a call requires a directory login when auth-calls is true; with auth-calls absent or false, no credentials are needed. Deployments without mod_rtmp loaded, or not accepting RTMP, are not exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000771,"input_tokens":4500,"output_tokens":642,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116568':14A,17A '-2026':13A,16A '1.11.2':27B,93C,223C '1935':166C 'absent':190C 'accept':158C 'activ':57B,201C 'advanc':129C 'affect':149C 'auth':176C,187C 'auth-cal':175C,186C 'beyond':132C 'bound':46B 'buffer':135C 'build':152C 'byte':111C,126C 'call':11A,58B,160C,169C,177C,188C,202C 'caus':41B 'check':107C 'client':50B,195C 'code':61B 'commod':89C 'common':162C 'could':143C 'counter':127C 'craft':2A 'crash':6A,52B,144C 'credenti':182C 'cve':12A,15A 'declar':119C 'defect':205C 'defin':70C 'demonstr':65B,216C 'deploy':150C 'digit':75C 'directori':172C 'disclosur':212C 'enabl':73C 'everi':56B,200C 'execut':62B 'fals':192C 'fix':220C 'flaw':148C 'freeswitch':1A,18B,25B,53B,66C,198C 'h.264':30B,103C 'hardwar':90C 'host':23B 'implement':84C 'inbound':102C 'issu':218C 'length':33B,98C,140C 'length-prefix':139C 'load':154C 'login':173C 'memori':211C 'messag':116C 'mishandl':28B 'mod':37B,155C 'nal':31B,104C 'next':138C 'out-of-bound':43B 'overs':29B,118C 'packet':5A 'parser':131C 'path':40B 'place':167C 'port':165C 'prefix':34B,99C,141C 'primit':209C 'prior':91C 'process':8A,146C 'proprietari':78C 'read':47B,142C 'receiv':134C 'remain':112C,125C 'remaining-byt':124C 'remot':49B,194C 'requir':170C,184C 'rtmp':3A,19B,38B,94C,115C,156C 'rtmp2rtph264':95C 'run':86C 'runtim':20B 'self':22B 'self-host':21B 'session':161C 'softwar':69C,83C 'stack':72C 'suppli':206C 'switch':80C 'tcp':164C 'telecom':71C,79C 'telephoni':24B 'termin':55B,197C 'though':59B 'transform':76C 'true':179C 'trust':96C 'underflow':121C 'unit':32B,105C,120C 'unsign':123C 'version':222C 'video':4A,39B,159C 'without':106C 'write':208C","nicknames":[],"mitigations":[],"who_affected":"Deployments that build and load mod_rtmp and accept RTMP video call sessions, commonly on TCP port 1935. Placing a call requires a directory login when auth-calls is true; with auth-calls absent or false, no credentials are needed. Deployments without mod_rtmp loaded, or not accepting RTMP, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","high","rtmp","runtime","selfhosted","telephony"],"campaign_type":null,"first_public_at":"2026-10-26T21:11:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116568","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116568","severity":null,"published_at":"2026-11-05T20:17:43+00:00","modified_at":"2026-11-05T20:17:43+00:00","first_seen_at":"2026-11-05T20:40:44+00:00","fetched_at":"2026-11-05T20:40:44+00:00","note":null}],"documents":[{"id":79843,"url":"https://github.com/signalwire/freeswitch/commit/72cda5bfad67d14d8dbe76b8f8bdd38c4fa5c932","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79845,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-2gp7-f34j-j4xw","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T21:11:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}