Buffer Overflow Vulnerability in FreeSWITCH Affected by Unauthenticated RTMP User-Control Messages

CVE-2026-116567

What is CVE-2026-116567?

The vulnerability in FreeSWITCH involves a buffer overflow caused by the rtmp_handle_control() function, which improperly processes RTMP user-control messages. This flaw can trigger a crash in the FreeSWITCH application by overflowing a 200-byte stack buffer using an unbounded sprintf loop based on the wire message length. Notably, the message length can exceed 70 bytes without prior authentication, allowing for unauthenticated messages to disrupt active calls on deployments using the mod_rtmp module. Although the default configuration disables mod_rtmp, it typically listens on TCP port 1935 when enabled, creating a potential risk. The issue has been resolved in FreeSWITCH version 1.11.2.

References