{"id":"CVE-2026-116571","kind":"vulnerability","aliases":["CVE-2026-116571"],"related":[],"title":"FreeSWITCH: oversized H.264 parameter sets overflow stack in RTMP bridging","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtp2rtmpH264() built an AVC decoder configuration record in a fixed stack buffer by copying wire-derived SPS and PPS values without checking that their sizes and framing fit. An established H.264 call bridged toward an RTMP endpoint could supply oversized SPS and PPS parameter sets and overrun the function's stack frame. The flaw affects only deployments that build and load mod_rtmp and bridge RTP media into an RTMP leg; the module is disabled in the stock build and configuration. The corruption can abort FreeSWITCH and terminate every active call, and builds without stack protection receive a limited stack-write primitive, although code execution has not been demonstrated. This issue is fixed in version 1.11.2.","summary":"FreeSWITCH's mod_rtmp copies H.264 SPS and PPS values from an RTP call into a fixed stack buffer without size checks when bridging to an RTMP endpoint. An attacker sending oversized parameter sets can crash FreeSWITCH, dropping every active call, and on builds without stack protection gets a limited stack-write primitive; code execution has not been demonstrated.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeswitch","rtmp","runtime","telecom","voip"],"not_affected_if":["default-config","mod-rtmp-not-loaded","no-rtmp-bridging"],"how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and compare it against `1.11.2`.\n- Confirm whether mod_rtmp is built and loaded, for example with `fs_cli -x 'module_exists mod_rtmp'` or by looking for mod_rtmp in the modules configuration.\n- Check whether any dialplan or bridge routes RTP media into an RTMP leg.","fix":"- FreeSWITCH: upgrade to `1.11.2`.","status":"open","published_at":"2026-11-05T20:17:44+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","triaged_at":"2026-11-05T20:43:25+00:00","updated_at":"2026-11-05T20:43:25+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-05T20:43:25Z","model":"claude-haiku-5-5","output":{"fix":"- FreeSWITCH: upgrade to `1.11.2`.","reach":"network","title":"FreeSWITCH: oversized H.264 parameter sets overflow stack in RTMP bridging","impact":"medium","summary":"FreeSWITCH's mod_rtmp copies H.264 SPS and PPS values from an RTP call into a fixed stack buffer without size checks when bridging to an RTMP endpoint. An attacker sending oversized parameter sets can crash FreeSWITCH, dropping every active call, and on builds without stack protection gets a limited stack-write primitive; code execution has not been demonstrated.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["freeswitch","telecom","rtmp","voip"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Remote crash of FreeSWITCH and termination of all calls; possible limited stack write","analyst_note":"","how_to_check":"- Check the FreeSWITCH version with `fs_cli -x version` and compare it against `1.11.2`.\n- Confirm whether mod_rtmp is built and loaded, for example with `fs_cli -x 'module_exists mod_rtmp'` or by looking for mod_rtmp in the modules configuration.\n- Check whether any dialplan or bridge routes RTP media into an RTMP leg.","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","mod-rtmp-not-loaded","no-rtmp-bridging"],"who_is_affected":"Only deployments that build and load mod_rtmp and bridge RTP media into an RTMP leg are exposed, since the module is disabled in the stock build and configuration. Systems running FreeSWITCH without mod_rtmp, or without RTP-to-RTMP bridging, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000789,"input_tokens":4488,"output_tokens":681,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116571':13A,16A '-2026':12A,15A '1.11.2':109C,228C 'abort':196C 'activ':61B,201C 'affect':166C 'although':215C 'attack':51B 'avc':114C 'bridg':10A,45B,144C,176C 'buffer':40B,122C 'build':65B,170C,190C,204C 'built':112C 'call':35B,62B,143C,202C 'check':43B,133C 'code':76B,216C 'commod':105C 'configur':116C,192C 'copi':26B,124C 'corrupt':194C 'could':149C 'crash':57B 'cve':11A,14A 'decod':115C 'defin':86C 'demonstr':81B,221C 'deploy':168C 'deriv':127C 'digit':91C 'disabl':186C 'drop':59B 'enabl':89C 'endpoint':49B,148C 'establish':141C 'everi':60B,200C 'execut':77B,217C 'fit':139C 'fix':38B,120C,225C 'flaw':165C 'frame':138C,163C 'freeswitch':1A,17B,22B,58B,82C,197C 'function':160C 'get':69B 'h.264':3A,27B,142C 'hardwar':106C 'implement':100C 'issu':223C 'leg':182C 'limit':71B,210C 'load':172C 'media':178C 'mod':24B,173C 'modul':184C 'overflow':6A 'overrun':158C 'overs':2A,53B,151C 'paramet':4A,54B,155C 'pps':30B,130C,154C 'primit':75B,214C 'prior':107C 'proprietari':94C 'protect':68B,207C 'receiv':208C 'record':117C 'rtmp':9A,18B,25B,48B,110C,147C,174C,181C 'rtp':34B,177C 'rtp2rtmph264':111C 'run':102C 'runtim':19B 'send':52B 'set':5A,55B,156C 'size':42B,136C 'softwar':85C,99C 'sps':28B,128C,152C 'stack':7A,39B,67B,73B,88C,121C,162C,206C,212C 'stack-writ':72B,211C 'stock':189C 'suppli':150C 'switch':96C 'telecom':20B,87C,95C 'termin':199C 'toward':145C 'transform':92C 'valu':31B,131C 'version':227C 'voip':21B 'wire':126C 'wire-deriv':125C 'without':41B,66B,132C,205C 'write':74B,213C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that build and load mod_rtmp and bridge RTP media into an RTMP leg are exposed, since the module is disabled in the stock build and configuration. Systems running FreeSWITCH without mod_rtmp, or without RTP-to-RTMP bridging, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeswitch","medium","rtmp","runtime","telecom","voip"],"campaign_type":null,"first_public_at":"2026-10-26T21:10:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116571","severity":null,"published_at":"2026-11-05T20:17:44+00:00","modified_at":"2026-11-05T20:17:44+00:00","first_seen_at":"2026-11-05T20:40:45+00:00","fetched_at":"2026-11-05T20:40:45+00:00","note":null}],"documents":[{"id":79852,"url":"https://github.com/signalwire/freeswitch/commit/2ab0a534fdc25301daf95590e90a756a76bf0950","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":79176,"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":79854,"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-qmh2-f6cv-79mf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T21:10:57+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}