{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/freeswitch--1.11.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:freeswitch:freeswitch:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-116567"},{"cvss":7.5,"id":"CVE-2026-116782"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FreeSWITCH (\u003c 1.11.2)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FreeSWITCH"],"content_html":"\u003cp\u003eCVE-2026-116567 is a pre-authentication stack overflow vulnerability within the FreeSWITCH \u003ccode\u003emod_rtmp\u003c/code\u003e module, specifically in the \u003ccode\u003ertmp_handle_control()\u003c/code\u003e function. An attacker can send a crafted RTMP user-control message to trigger an unbounded \u003ccode\u003esprintf\u003c/code\u003e loop, corrupting a 200-byte stack buffer and causing the FreeSWITCH process to crash. The exploit author also includes targeting for a second vulnerability, CVE-2026-116782, triggered by non-object AMF arguments. The module is disabled by default in standard distributions, reducing the attack surface.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker probes TCP port 1935 on the target host.\u003c/li\u003e\n\u003cli\u003eAttacker initiates RTMP handshake (C0/C1) and waits for server response (S0/S1/S2).\u003c/li\u003e\n\u003cli\u003eAttacker sends \u003ccode\u003econnect\u003c/code\u003e command (AMF0) targeting \u003ccode\u003elive\u003c/code\u003e, \u003ccode\u003esofia\u003c/code\u003e, or \u003ccode\u003edefault\u003c/code\u003e application.\u003c/li\u003e\n\u003cli\u003eAttacker inspects server \u003ccode\u003efmsVer\u003c/code\u003e response; if \u003ccode\u003e1\u003c/code\u003e, the target is identified as \u003ccode\u003emod_rtmp\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAttacker negotiates \u003ccode\u003eSetChunkSize 4096\u003c/code\u003e to ensure the payload remains in a single chunk.\u003c/li\u003e\n\u003cli\u003eAttacker sends a crafted RTMP \u003ccode\u003eUSERCTRL 0x04\u003c/code\u003e message with a payload \u0026gt; 70 bytes.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ertmp_handle_control()\u003c/code\u003e function overflows the fixed 200-byte stack buffer, resulting in a process crash.\u003c/li\u003e\n\u003cli\u003eAttacker polls the service port to confirm the listener is down, achieving a denial-of-service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact is a crash of the FreeSWITCH process, leading to a denial-of-service. Active calls are dropped. Because the overflow writes via \u003ccode\u003e%02x\u003c/code\u003e formatting, the control over the execution flow is limited to ASCII hex digits, making this primarily a DoS rather than a remote code execution (RCE) vector.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInventory all FreeSWITCH instances and verify the status of \u003ccode\u003emod_rtmp\u003c/code\u003e. Disable the module if it is not strictly required.\u003c/li\u003e\n\u003cli\u003eUpgrade all instances running versions older than 1.11.2 to the latest patched version.\u003c/li\u003e\n\u003cli\u003eImplement network-level access control lists (ACLs) to restrict access to port 1935 to trusted sources only.\u003c/li\u003e\n\u003cli\u003eDeploy the suggested hunt leads to detect reconnaissance and exploitation attempts against RTMP services.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-11-09T05:17:29Z","date_published":"2026-11-09T05:17:29Z","id":"https://feed.craftedsignal.io/briefs/2026-11-freeswitch-stack-overflow/","summary":"A public exploit exists for a pre-authentication stack overflow in FreeSWITCH mod_rtmp allowing remote denial-of-service, alongside a related issue (CVE-2026-116782).","title":"FreeSWITCH: Pre-authentication stack overflow in mod_rtmp (CVE-2026-116567)","url":"https://feed.craftedsignal.io/briefs/2026-11-freeswitch-stack-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - FreeSWITCH (\u003c 1.11.2)","version":"https://jsonfeed.org/version/1.1"}