Stack Buffer Overflow in FreeSWITCH RTMP Module

CVE-2026-116571

What is CVE-2026-116571?

The stack buffer overflow vulnerability in the RTMP module of FreeSWITCH allows oversized SPS and PPS parameter sets to corrupt the stack frame. This occurs when interconnecting an H.264 call to an RTMP endpoint, potentially causing the FreeSWITCH application to crash and terminate all active calls. Deployments using mod_rtmp and bridging RTP media are particularly at risk, though the module is typically disabled in the default build. Notably, builds lacking stack protection are susceptible to limited stack-write primitives, implying some level of exploitation risk. The vulnerability has been addressed in version 1.11.2.

References