CVE-2026-116567

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The rtmp handle control() function renders an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A message body of approximately 70 bytes or more can overflow the stack before any RTMP login occurs, as the handshake does not authenticate either party. This issue affects deployments that build and load the mod rtmp module, which typically exposes a listener on TCP port 1935. A single unauthenticated message can cause the application to crash and terminate all active calls.

Recommendations Update to version 1.11.2. As a temporary mitigation, disable the mod rtmp module if it is not required.