Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T20:17:43.993Z",
  "pubdate": "2026-11-05T20:17:43.993Z",
  "executiveSummary": "This vulnerability is an out-of-bounds read flaw within the RTMP message parsing logic of FreeSWITCH, specifically impacting the rtmp_rtmp2rtpH264() function. The issue arises from a failure to validate the length prefix of inbound H.264 NAL units against the actual remaining buffer size. By providing an oversized length declaration, a remote attacker can induce an integer underflow in the remaining-byte counter, forcing the parser to access memory addresses beyond the designated receive buffer. The impact is primarily a denial-of-service, leading to process termination and the dropping of all active calls. The flaw affects FreeSWITCH versions prior to 1.11.2 in deployments utilizing the mod_rtmp module. Successful exploitation requires an attacker to initiate an RTMP video call session. While authentication is required if auth-calls is configured to true, deployments with auth-calls disabled or absent allow unauthenticated access to the vulnerable parser. Although the vulnerability does not currently support arbitrary code execution or memory disclosure, it poses a significant availability risk to telecom infrastructure running vulnerable configurations.",
  "technicalDetails": "The vulnerability resides in the rtmp_rtmp2rtpH264() function within the mod_rtmp module of FreeSWITCH. The function is responsible for parsing H.264 Network Abstraction Layer (NAL) units encapsulated within RTMP streams. The core of the flaw is a lack of bounds checking when processing the length prefix assigned to each NAL unit.\nDuring packet processing, the function reads a length prefix from the incoming RTMP stream. The code assumes this prefix accurately reflects the subsequent payload size without verifying it against the actual number of bytes remaining in the RTMP message buffer. When a malicious payload specifies an NAL unit length that exceeds the remaining buffer size, the unsigned integer tracking the remaining bytes undergoes an underflow. This results in the counter wrapping to a large positive value.\nBecause the parser relies on this underflowed counter for buffer pointer arithmetic, the internal read pointer is advanced beyond the allocated memory segment. Subsequent operations attempt to read the next length-prefix from an out-of-bounds memory location. This illegal memory access triggers a process fault, leading to an immediate crash of the FreeSWITCH process.\nThe attack flow begins with the establishment of an RTMP connection, typically over TCP port 1935. In environments where the 'auth-calls' parameter is set to false or omitted, the attacker can initiate the connection without credentials. If 'auth-calls' is enabled, the attacker must first successfully authenticate via a directory login. Once the session is established, the attacker sends a malformed H.264-encoded RTMP packet containing the oversized length prefix.\nThe reachability is high for any exposed FreeSWITCH deployment utilizing the mod_rtmp module to process video calls. As there is no memory disclosure or write primitive identified, the current exploitability is limited to causing service interruption. The process termination affects the entire FreeSWITCH instance, effectively dropping all concurrent active calls, which can cause significant disruption in production telecom environments. This vulnerability is patched in version 1.11.2, which introduces proper boundary validation logic to ensure that NAL unit length prefixes are explicitly checked against the remaining payload buffer before pointer arithmetic occurs."
}