CVE-2026-116782 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a comprehensive software-defined telecommunications stack designed to facilitate the migration from proprietary hardware switches to flexible software implementations running on commodity hardware. Within this architecture, the mod_rtmp module facilitates Real-Time Messaging Protocol connectivity, which is critical for media streaming and interactive communication scenarios. However, prior to version 1.11.2, a significant input validation flaw existed within the rtmp_i_connect function responsible for handling initial connection requests from clients. This vulnerability stems from an insufficient check on the data type of the first argument passed during the RTMP connect sequence. Specifically, the code invoked amf0_object_get() assuming that the incoming AMF value was strictly an object structure, failing to verify this assumption before proceeding with memory operations based on that expectation.
The technical core of this vulnerability lies in a classic improper input validation error where type confusion leads to unsafe memory access. When a client sends a malformed connect command containing a string or number instead of the expected AMF object, the internal parsing logic misinterprets the raw bytes of these primitive types as pointers to data structures. Consequently, the application attempts to dereference these invalid addresses, treating arbitrary union bytes from the message payload as valid node pointers in memory. This action triggers an invalid read operation because the memory locations pointed to by these fabricated pointers are either unmapped or contain unrelated data that cannot be safely accessed according to the program's logic flow.
From a security impact perspective, this flaw results in a reliable denial of service condition rather than a compromise of confidentiality or integrity. The immediate operational consequence is the crash of the FreeSWITCH process upon receipt of the malicious packet. This crash terminates all active calls and disrupts telecommunication services for any users connected to the affected instance at that moment. While no write operations, memory disclosure, or remote code execution have been demonstrated in this specific vector, the reliability of the crash makes it a potent tool for attackers seeking to destabilize critical communication infrastructure. The vulnerability is classified under CWE-20 as Improper Input Validation and aligns with ATT&CK technique T1499 Endpoint Denial of Service due to its ability to disrupt service availability through resource exhaustion or application failure.
It is important to note that the practical exploitability of this vulnerability in default environments is limited because the mod_rtmp module is disabled by default in both stock builds and standard configurations. Therefore, an attacker must have network access to a system where RTMP functionality has been explicitly enabled and configured. Despite this mitigation-by-default posture, any organization running FreeSWITCH with custom configurations that enable RTMP services remains at risk if they do not apply the necessary patches. The vulnerability highlights the importance of rigorous input validation in protocol parsers, particularly when handling complex binary formats like AMF where type distinctions are critical for safe memory management.
To mitigate this issue and prevent similar vulnerabilities in future deployments, organizations must ensure that FreeSWITCH is updated to version 1.11.2 or later, which includes the fix for the rtmp_i_connect function. The patch introduces proper type checking before invoking amf0_object_get(), ensuring that only valid AMF objects are processed as such and preventing the misinterpretation of primitive types as pointers. Additionally, security administrators should adhere to the principle of least privilege by disabling unnecessary modules like mod_rtmp if RTMP connectivity is not explicitly required for business operations. Regular vulnerability scanning and configuration audits can help identify instances where default secure settings have been altered, thereby reducing the attack surface available to potential adversaries seeking to exploit such input validation flaws.