{"id":"CVE-2026-116568","published":"2026-11-05T20:17:43.993","lastModified":"2026-11-05T22:38:13.080","description":"FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-125","CWE-191"],"vendors":[],"products":[],"references":[{"url":"https://github.com/signalwire/freeswitch/commit/72cda5bfad67d14d8dbe76b8f8bdd38c4fa5c932","tags":[]},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","tags":[]},{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-2gp7-f34j-j4xw","tags":[]}],"exploitRefs":[{"url":"https://github.com/signalwire/freeswitch/commit/72cda5bfad67d14d8dbe76b8f8bdd38c4fa5c932","tags":[]},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","tags":[]},{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-2gp7-f34j-j4xw","tags":[]}],"hasPoc":true,"ai":null}