FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation…
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtp2rtmpH264() built an AVC decoder configuration record in a fixed stack buffer by copying wire-derived SPS and PPS values without checking that their sizes and framing fit. An established H.264 call bridged toward an RTMP endpoint could supply oversized SPS and PPS parameter sets and overrun the function's stack frame. The flaw affects only deployments that build and load mod_rtmp and bridge RTP media into an RTMP leg; the module is disabled in the stock build and configuration. The corru
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Signalwire
- Product
- freeswitch
- CVSS v3.1
- 5.9 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Fix
- available
- Weakness
- CWE-121
- Exposure class
- Collaboration
- NVD status
- Awaiting Analysis
Why it ranks 28 (Notable)
- CVSS v3.1 5.9 medium
- Product class: collaboration
- Fix available
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
- CVE-2026-116571 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.