CVE-2026-116567

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A body of roughly 70 bytes or more overflowed the stack before any RTMP login, because the handshake authenticates neither side. The flaw affects deployments that build and load mod_rtmp, which is disabled in the stock build and configuration but commonly exposes a listener on TCP port 1935 when enabled. One unauthenticated message can crash FreeSWITCH and end every active call; the constrained ASCII hex output has not yielded control-flow hijacking. This issue is fixed in version 1.11.2.

• CWE-121

• https://github.com/signalwire/freeswitch/commit/fc0db829b87d1a5a3043e355b4294c41851b13c6
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.2
• https://github.com/signalwire/freeswitch/security/advisories/GHSA-hj6x-9653-p796

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116555A vulnerability has been found in Argilla up to 2.8.0. The i…2.4
• CVE-2026-116556A vulnerability was found in Argilla up to 2.8.0. This affec…2.4
• CVE-2026-116557The WP Booking System - Booking Calendar plugin for WordPres…9.1
• CVE-2026-11656Use after free in ServiceWorker in Google Chrome prior to 14…8.3
• CVE-2026-116563The Photo Gallery, Sliders, Proofing and Themes – NextGEN Ga…5.4
• CVE-2026-116566socket.getaddrinfo() previously accepted null bytes within *…5.3
• CVE-2026-116568FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-116569FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-11657Use after free in Payments in Google Chrome on Mac prior to …8.8
• CVE-2026-116570FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-116571FreeSWITCH is a Software Defined Telecom Stack enabling the …5.9
• CVE-2026-116572FreeSWITCH is an open-source software telecommunications pla…6.5