Buffer Overflow in FreeSWITCH Prior to Version 1.11.2
CVE-2026-116568
7.5HIGH
What is CVE-2026-116568?
The Buffer Overflow vulnerability in FreeSWITCH prior to version 1.11.2 occurs due to improper validation of H.264 NAL unit length prefixes within the rtmp_rtmp2rtpH264() function. This flaw allows a remote client to send oversized units that can cause the parser to advance beyond its receive buffer, terminating the FreeSWITCH process and affecting all active calls. Although this defect does not provide a means to write or disclose memory, it poses significant operational risks, particularly for deployments using mod_rtmp on TCP port 1935. Users are encouraged to upgrade to version 1.11.2 or later to mitigate this risk.
Affected Version(s)
freeswitch < 1.11.2