Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-05T20:17:45.247Z",
  "pubdate": "2026-11-05T20:17:45.247Z",
  "executiveSummary": "A critical type-confusion vulnerability exists in the FreeSWITCH RTMP module (mod_rtmp) prior to version 1.11.2, stemming from improper validation of AMF (Action Message Format) data types. The vulnerability allows a remote, unauthenticated attacker to trigger an invalid memory read, resulting in a denial-of-service (DoS) condition.\nThe flaw resides in the rtmp_i_connect() function, which fails to verify that a supplied AMF value is an object before passing it to amf0_object_get(). By providing a string or number instead of the expected object structure, an attacker forces the application to misinterpret arbitrary union bytes as memory pointers, leading to a dereference of invalid addresses.\nWhile the vulnerability currently facilitates system crashes that terminate all active telecom calls, there is no evidence of arbitrary code execution or memory disclosure. Exploitation is contingent upon the mod_rtmp listener being explicitly enabled in the configuration, as it is disabled by default in stock builds. The risk is primarily operational, impacting service availability for telecom environments utilizing the RTMP stack.",
  "technicalDetails": "The root cause of this vulnerability is a type-confusion flaw within the mod_rtmp module of FreeSWITCH. Specifically, the rtmp_i_connect() function processes incoming RTMP connect commands without performing adequate schema validation on the AMF0-encoded parameters. In the vulnerable implementation, the function blindly passes the first argument from the RTMP connect command into the amf0_object_get() function.\nThe amf0_object_get() function assumes that the provided input is a valid AMF object data structure. However, because the input is not validated, an attacker can substitute the expected object with alternative AMF types, such as a string or a numeric value. When the internal logic encounters this malformed input, it misinterprets the raw byte representation of the data as a pointer to an AMF node structure.\nUpon reaching the dereference instruction, the application attempts to access memory at the address derived from these misinterpreted bytes. Because the bytes do not represent a valid memory address or an initialized object, the process triggers an invalid read operation, resulting in an immediate segmentation fault and process crash.\nThe attack flow proceeds as follows: 1) The attacker establishes a network connection to the target FreeSWITCH instance on the port configured for mod_rtmp. 2) The attacker transmits a malformed RTMP connect command packet before the authentication phase of the session. 3) The rtmp_i_connect() function parses the malicious packet and improperly passes the unexpected AMF data type to the object handler. 4) The module attempts to process the non-object data as a pointer, resulting in an unhandled memory access error and a complete crash of the FreeSWITCH service.\nThis vulnerability is present in versions of FreeSWITCH prior to 1.11.2. The exploitation does not require prior authentication or privileged access, but it is limited by the module's deployment status; if the module is disabled or the specific listener is not active, the attack vector is effectively neutralized. Current analysis indicates the impact is limited to a reliable denial-of-service, as the nature of the invalid read has not been successfully leveraged to achieve code execution or sensitive information extraction."
}