CVE-2026-116568 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a critical software-defined telecommunications stack that facilitates the migration from proprietary hardware switches to flexible software implementations running on commodity hardware. Within this ecosystem, the mod_rtmp module handles Real-Time Messaging Protocol traffic, which is commonly utilized for video call sessions over TCP port 1935. A significant security vulnerability was identified in versions prior to 1.11.2 involving the function rtmp_rtmp2rtpH264(). This component is responsible for processing inbound H.264 Network Abstraction Layer units during media streams. The core technical flaw lies in the failure of this function to validate the length prefix declared within each H.264 NAL unit against the actual number of bytes remaining in the current RTMP message buffer. By trusting the external input without cross-referencing it with the internal state, the application creates a condition where an oversized declared unit can manipulate memory access patterns dangerously.
The operational mechanism of this flaw involves integer underflow and subsequent out-of-bounds read operations. When an attacker supplies an H.264 NAL unit with a length prefix that exceeds the remaining bytes in the message buffer, the unsigned counter tracking remaining bytes undergoes an underflow. This mathematical error causes the parser to advance its pointer beyond the boundaries of the receive buffer. As the parsing logic continues, it attempts to read the next length-prefix from memory locations outside the allocated buffer space. Because this out-of-bounds access occurs in a context where only read operations are performed on the invalid memory region, the immediate consequence is typically a segmentation fault or process crash rather than arbitrary code execution or data exfiltration. Consequently, while the defect does not provide a write primitive and there is no demonstrated capability for remote information disclosure, it represents a severe denial of service vector that can terminate the FreeSWITCH process along with all active call sessions associated with that instance.
From an access control perspective, the exploitability of this vulnerability depends heavily on the configuration of the mod_rtmp module. In deployments where authentication is enforced via the auth-calls directive set to true, a remote attacker must possess valid directory credentials to initiate a video session and trigger the malformed packet sequence. However, in configurations where auth-calls is absent or explicitly disabled, the service accepts unauthenticated connections. This allows any remote client on the network with access to TCP port 1935 to send crafted H.264 payloads that induce the buffer underflow, leading to a complete service outage. The lack of authentication requirements in many default or legacy configurations significantly expands the attack surface, making this vulnerability particularly dangerous for public-facing or poorly segmented telecom infrastructure.
This vulnerability aligns with CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Read within standard classification systems. In terms of adversary behavior, it corresponds to ATT&CK technique T1499 Endpoint Denial of Service, as the primary impact is the disruption of availability rather than confidentiality or integrity. To mitigate this risk, organizations running FreeSWITCH must upgrade immediately to version 1.11.2 or later, where the rtmp_rtmp2rtpH264 function has been patched to properly validate length prefixes against buffer limits before processing. Additionally, administrators should review their mod_rtmp configurations and ensure that auth-calls is enabled for all incoming video sessions unless there is a specific, secured requirement otherwise. Implementing network-level access control lists to restrict port 1935 traffic to trusted sources provides an additional layer of defense-in-depth against unauthenticated exploitation attempts while the software update is being deployed across the infrastructure.