CVE-2026-116782High· 7.5▾ TwilightFreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTM…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
freeswitch < 1.11.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116568High· 7.5FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
CVE-2026-116784High· 7.5FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing
CVE-2026-116780Low· 2.7FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing
CVE-2026-116787High· 7.5FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length
CVE-2026-116572Medium· 6.5FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name
CVE-2026-116573Medium· 6.5FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user