CVE-2026-116571
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtp2rtmpH264() built an AVC decoder configuration record in a fixed stack buffer by copying wire-derived SPS and PPS values without checking that their sizes and framing fit. An established H.264 call bridged toward an RTMP endpoint could supply oversized SPS and PPS parameter sets and overrun the function's stack frame. The flaw affects only deployments that build and load mod_rtmp and bridge RTP media into an RTMP leg; the module is disabled in the stock build and configuration. The corruption can abort FreeSWITCH and terminate every active call, and builds without stack protection receive a limited stack-write primitive, although code execution has not been demonstrated. This issue is fixed in version 1.11.2.
- Score
- 5.9 medium
- Published
- 2026-11-05
- Links
- NVD · cve.org · Report wrong data
Matched ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| net/freeswitch | freeswitch | 1.11.1_3 | unaddressed | pi@FreeBSD.org |
Template for a VuXML entry
Check the version numbers before you commit this entry. Some ports share an entry in the CVE database with another port, such as sqlite2 and sqlite3. The version shown here may then be one that never existed for this port.
Ranges per package from the CVE rows that match this port, in pkg notation with the port's epoch and revision, every bound checked with pkg; one range per epoch the port actually had. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>freeswitch -- FIXME</topic>
<affects>
<package>
<name>freeswitch</name>
<range><lt>1.11.2</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>CVE-2026-116571: FreeSWITCH is a Software Defined Telecom Stack
enabling the digital transformation from proprietary telecom
switches to a software implementation that runs on any commodity
hardware. Prior to 1.11.2, rtmp_rtp2rtmpH264() built an AVC decoder
configuration record in a fixed stack buffer by copying wire-
derived SPS and PPS values without checking that their sizes and
framing fit. An established H.264 call bridged toward an RTMP
endpoint could supply oversized SPS and PPS parameter sets and
overrun the function's stack frame. The flaw affects only
deployments that build and load mod_rtmp and bridge RTP media into
an RTMP leg; the module is disabled in the stock build and
configuration. The corruption can abort FreeSWITCH and terminate
every active call, and builds without stack protection receive a
limited stack-write primitive, although code execution has not been
demonstrated. This issue is fixed in version 1.11.2.</p>
</body>
</description>
<references>
<cvename>CVE-2026-116571</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2026-116571</url>
</references>
<dates>
<discovery>2026-11-05</discovery>
<entry>2026-11-05</entry>
</dates>
</vuln>