CVE-2026-116568

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The rtmp rtmp2rtpH264() function trusts the length prefix of inbound H.264 NAL units without verifying them against the remaining bytes in the RTMP message. An oversized declared unit can cause an underflow of the unsigned remaining-byte counter, advancing the parser beyond the receive buffer. This can lead to a process crash during the subsequent length-prefix read. The issue affects deployments using mod rtmp that accept video call sessions, typically on TCP port 1935. A remote client can trigger this to terminate the service and all active calls.

Recommendations Update to version 1.11.2. Restrict access to TCP port 1935 or disable the mod rtmp module to minimize the risk of exploitation.