CVE-2026-116571

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The rtmp rtp2rtmpH264() function creates an AVC decoder configuration record in a fixed stack buffer by copying SPS and PPS values derived from the wire without verifying if their sizes and framing fit. An established H.264 call bridged to an RTMP endpoint can provide oversized SPS and PPS parameter sets, leading to a stack frame overrun. This issue specifically affects deployments that build and load mod rtmp and bridge RTP media into an RTMP leg. The resulting memory corruption can cause the application to abort and terminate all active calls. In builds lacking stack protection, this provides a limited stack-write primitive.

Recommendations Update to version 1.11.2. As a temporary mitigation, avoid loading the mod rtmp module or bridging RTP media into an RTMP leg.