Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_handle_control() rendered an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A body of roughly 70 bytes or more overflowed the stack before any RTMP login, because the handshake authenticates neither side. The flaw affects deployments that build and load mod_rtmp, which is disabled in the stock build and configuration but commonly exposes a listener on TCP port 1935 when enabled. One unauthenticated message can crash FreeSWITCH and end every active call; the constrained ASCII hex output has not yielded control-flow hijacking. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T20:17:43.837Z",
  "pubdate": "2026-11-05T20:17:43.837Z",
  "executiveSummary": "A stack-based buffer overflow vulnerability exists in the FreeSWITCH software-defined telecom stack prior to version 1.11.2, specifically within the mod_rtmp module.\nThe vulnerability is triggered by an unbounded sprintf operation when processing RTMP user-control messages. Because the RTMP handshake does not enforce mutual authentication, an attacker can exploit this flaw without possessing valid credentials.\nThe primary impact of this vulnerability is a denial-of-service (DoS) condition; an unauthenticated attacker can send a crafted packet exceeding 70 bytes to trigger a stack overflow, resulting in a system crash and the immediate termination of all active voice calls.\nThe vulnerability affects deployments where mod_rtmp is explicitly enabled and listening on TCP port 1935, as it is disabled in default configurations.\nWhile the current analysis suggests the constrained nature of ASCII hex output limits control-flow hijacking potential, the instability caused by the crash poses a significant operational risk to telecom infrastructure.",
  "technicalDetails": "The vulnerability resides in the rtmp_handle_control() function within the FreeSWITCH mod_rtmp module. The root cause is a classic stack-based buffer overflow resulting from an unbounded sprintf loop that processes incoming RTMP user-control messages.\nWhen processing these messages, the function utilizes a fixed-size 200-byte stack buffer. The sprintf operation fails to perform adequate bounds checking, using the wire message length provided by the packet header to dictate the copy operation. If an attacker provides a payload exceeding approximately 70 bytes, the buffer is overwritten.\nThe attack flow proceeds as follows: An unauthenticated attacker establishes a TCP connection to the FreeSWITCH instance on port 1935, where mod_rtmp is listening. The attacker then transmits a malicious RTMP user-control message. Because the RTMP protocol handshake implementation in this version does not verify the identity of the client, the malicious payload reaches the vulnerable rtmp_handle_control() function before authentication is established.\nThe lack of memory safety in the sprintf loop allows the input data to overflow the allocated stack memory, corrupting surrounding memory segments. In the context of this specific vulnerability, the overflow consistently induces a crash, causing the FreeSWITCH process to terminate unexpectedly. This results in the complete loss of all active calls currently being processed by the telecom stack.\nThe affected versions include all FreeSWITCH releases prior to 1.11.2. The vulnerability requires the mod_rtmp module to be loaded and active, which is not the case in a stock build; however, it remains a critical risk for deployments that have enabled the RTMP interface for specific telecom interoperability requirements. Although the current assessment indicates that the restricted ASCII hex output limits the ability to inject shellcode or achieve reliable control-flow hijacking, the resulting stability failure is sufficient for effective service disruption."
}