CVE-2026-116782 FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmpiconnect passed the first RTMP connect argument to amf0objectget without checking whether the...

CVE-2026-116782

Prior to version 1.11.2 , FreeSWITCH is vulnerable to an invalid pointer dereference within the mod_rtmp module. The root cause is that rtmp_i_connect() passes the first RTMP connect argument to amf0_object_get() without verifying if the AMF value is an object. Providing a string or number instea...