Invalid pointer dereference in FreeSWITCH mod_rtmp connect handling
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.
Summary
FreeSWITCH before 1.11.2 has a mod_rtmp connect handler that uses the first RTMP connect argument without checking that it is an AMF object, so it dereferences pointers taken from message bytes (CWE-125). An unauthenticated remote client with network access to an enabled mod_rtmp listener can crash FreeSWITCH and end all active calls. The module is disabled in the stock build and configuration. No write, memory disclosure or code execution has been demonstrated.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| signalwire | freeswitch | before 1.11.2 | 1.11.2 | Patch available | CNA |
- freeswitch Vendorsignalwire Affected before 1.11.2 Fixed in 1.11.2 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* | — | — | freeswitch |
- cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:* Versions — — ·freeswitch
Remediation
Update FreeSWITCH to version 1.11.2, the fixed version for signalwire freeswitch.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA freeswitch (signalwire) Fixed in 1.11.2
Vendor assessments
Timeline
- 2026-11-05 Threatist record created from CVE-2026-116782
- 2026-11-05 CISA SSVC decision points changed
- 2026-11-05 Priority changed: MEDIUM → LOW
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-07 Priority changed: LOW → MEDIUM
References
More signalwire vulnerabilities
- TI-2023-08915 heap-over-flow in stun_parse_attribute in sofia-sip CVSS 3.1CRITICAL 9.8
- TI-2022-13049 Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP CVSS 3.1CRITICAL 9.8
- TI-2023-28097 FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation CVSS 3.1HIGH 7.5
- TI-2023-20909 Resource allocation without limits in signalwire freeswitch CVSS 3.1HIGH 7.5
- TI-2023-20908 FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID CVSS 3.1HIGH 7.5
- TI-2023-15601 heap-over-flow and integer-overflow in sofia-sip CVSS 3.1HIGH 7.5
Sources
- CVE-2026-116782 · CVE Program
- CVE-2026-116782 · NVD
- FIRST EPSS
- CVE-2026-116782 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences