FreeSWITCH: Pre-authentication stack overflow in mod_rtmp (CVE-2026-116567)

CVE-2026-116567 is a pre-authentication stack overflow vulnerability within the FreeSWITCH mod_rtmp module, specifically in the rtmp_handle_control() function. An attacker can send a crafted RTMP user-control message to trigger an unbounded sprintf loop, corrupting a 200-byte stack buffer and causing the FreeSWITCH process to crash. The exploit author also includes targeting for a second vulnerability, CVE-2026-116782, triggered by non-object AMF arguments. The module is disabled by default in standard distributions, reducing the attack surface.

Attack Chain

1. Attacker probes TCP port 1935 on the target host.
2. Attacker initiates RTMP handshake (C0/C1) and waits for server response (S0/S1/S2).
3. Attacker sends connect command (AMF0) targeting live, sofia, or default application.
4. Attacker inspects server fmsVer response; if 1, the target is identified as mod_rtmp.
5. Attacker negotiates SetChunkSize 4096 to ensure the payload remains in a single chunk.
6. Attacker sends a crafted RTMP USERCTRL 0x04 message with a payload > 70 bytes.
7. The rtmp_handle_control() function overflows the fixed 200-byte stack buffer, resulting in a process crash.
8. Attacker polls the service port to confirm the listener is down, achieving a denial-of-service.

Impact

The primary impact is a crash of the FreeSWITCH process, leading to a denial-of-service. Active calls are dropped. Because the overflow writes via %02x formatting, the control over the execution flow is limited to ASCII hex digits, making this primarily a DoS rather than a remote code execution (RCE) vector.

Recommendation

1. Inventory all FreeSWITCH instances and verify the status of mod_rtmp. Disable the module if it is not strictly required.
2. Upgrade all instances running versions older than 1.11.2 to the latest patched version.
3. Implement network-level access control lists (ACLs) to restrict access to port 1935 to trusted sources only.
4. Deploy the suggested hunt leads to detect reconnaissance and exploitation attempts against RTMP services.