RTMP Connect Handling Flaw in FreeSWITCH Software from SignalWire

CVE-2026-116782

What is CVE-2026-116782?

FreeSWITCH, a software-defined telecom stack, contains a flaw in the handling of RTMP connections that allows a malformed connect command to crash the service. Specifically, prior to version 1.11.2, the function rtmp_i_connect() improperly processed the initial RTMP connect argument. If non-object AMF values (such as strings or numbers) were passed, it led to incorrect interpretation of data, resulting in invalid memory access during runtime. This issue can disrupt active calls but does not demonstrate any capabilities for data leakage or remote code execution. It’s important to note that the specific mod_rtmp listener is disabled in default installations, mitigating direct exploitation risks. Users are advised to upgrade to version 1.11.2 to ensure protection against this vulnerability.

References