CVE-2026-116782

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.

• CWE-125
• CWE-843

• https://github.com/signalwire/freeswitch/commit/150295ecff43b5ffecf43f250eef3c4fba37b6d5
• https://github.com/signalwire/freeswitch/releases/tag/v1.11.2
• https://github.com/signalwire/freeswitch/security/advisories/GHSA-v7mq-h638-6fxp

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-116776USB Test is a lightweight Windows CLI utility for verifying …7
• CVE-2026-116778FOG is a free open-source cloning/imaging/rescue suite/inven…8.8
• CVE-2026-116779FreeSWITCH is a Software Defined Telecom Stack enabling the …9.8
• CVE-2026-11678Integer overflow in libyuv in Google Chrome prior to 149.0.7…5.3
• CVE-2026-116780FreeSWITCH is a Software Defined Telecom Stack enabling the …2.7
• CVE-2026-116781FreeSWITCH is a Software Defined Telecom Stack enabling the …5.3
• CVE-2026-116783FreeSWITCH is a Software Defined Telecom Stack enabling the …8.2
• CVE-2026-116784FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-116785FreeSWITCH is a Software Defined Telecom Stack enabling the …9.1
• CVE-2026-116786FreeSWITCH is a Software Defined Telecom Stack enabling the …8.8
• CVE-2026-116787FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2026-116788FreeSWITCH is an open-source software telecommunications pla…8.2