FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation…
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends ev
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Signalwire
- Product
- freeswitch
- CVSS v3.1
- 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Exploitation
- SSVC none, automatable yes, impact partial
- Fix
- available
- Weakness
- CWE-125, CWE-843
- Exposure class
- Collaboration
- NVD status
- Awaiting Analysis
Why it ranks 39 (Notable)
- CVSS v3.1 7.5 high
- SSVC: automatable
- Product class: collaboration
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-116782 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.