CVE-2026-116782

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmpiconnect passed the first RTMP connect argument to amf0objectget without checking whether the...

CVE-2026-116782 FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmpiconnect passed the first RTMP connect argument to amf0objectget without checking whether the...

CVE-2026-116782

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmpiconnect passed the first RTMP connect argument to amf0objectget without checking whether the...

CVE-2026-116567

Prior to version 1.11.2 , FreeSWITCH is vulnerable to a pre-authentication stack buffer overflow in the mod_rtmp module. The vulnerability exists in the rtmp_handle_control() function, where an unbounded sprintf loop renders an RTMP user-control message into a 200-byte stack buffer. An attacker c...

CVE-2026-116571

The FreeSWITCH telecom stack contains a stack buffer overflow in the mod_rtmp module, specifically within the rtmp_rtp2rtmpH264() function. The vulnerability occurs because the software copies wire-derived SPS and PPS values into a fixed stack buffer without verifying that the sizes and framing f...

CVE-2026-116568

The FreeSWITCH software (versions prior to 1.11.2 ) contains an out-of-bounds read vulnerability in the mod_rtmp component. The root cause is located in the rtmp_rtmp2rtpH264() function, which fails to validate the length prefix of inbound H.264 NAL units against the bytes remaining in the RTMP m...

CVE-2026-116568 FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmprtmp2rtpH264 trusted the length prefix of each inbound H.264 NAL unit without checking it...