CVE-2026-116782

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.11.2

Description The rtmp i connect() function passes the first RTMP connect argument to amf0 object get() without verifying if the AMF (Action Message Format) value is an object. If a string or number is provided instead of an AMF object, union bytes from the message are interpreted as node pointers and dereferenced. A client with network access to an enabled mod rtmp listener can send a malformed connect command before login, resulting in an invalid read that crashes the system and terminates all active calls. The mod rtmp module is disabled by default in the stock build and configuration.

Recommendations Update to version 1.11.2. As a temporary mitigation, ensure the mod rtmp module remains disabled.