Is CVE-2026-116571 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116571 being exploited in the wild.

How severe is CVE-2026-116571?

Medium severity, with a CVSS score of 5.9, published 5 November 2026.

Which products and versions are affected?

SignalWire FreeSWITCH prior to 1.11.2.

How is CVE-2026-116571 attacked?

It is attacked over the network.

Am I affected by CVE-2026-116571?

Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116571: FreeSWITCH stack buffer overflow in mod_rtmp H.264 handling

CVE-2026-116571 · Severity: medium · CVSS 5.9 · Published 2026-11-05

FreeSWITCH is a software-based telephone system that enables calls to be routed and bridged between different networks and protocols. When the optional mod_rtmp module bridges a video call to an RTMP endpoint, an attacker can send oversized video parameter sets that overflow a fixed-size buffer on the call handler's stack, causing the entire system to crash and terminate all active calls. While code execution has not been demonstrated, a crash affecting all concurrent calls represents a denial-of-service risk to deployments using this feature.

Technologies: SignalWire FreeSWITCH. Vendors: SignalWire.

Quick answers

Is CVE-2026-116571 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116571 being exploited in the wild.
How severe is CVE-2026-116571?: Medium severity, with a CVSS score of 5.9, published 5 November 2026.
Which products and versions are affected?: SignalWire FreeSWITCH prior to 1.11.2.
Is there a fix for CVE-2026-116571?: Yes: fixed in 1.11.2. Until then: Disable mod_rtmp if RTMP bridging is not required, or restrict call routing to trusted RTMP endpoints only. The stock FreeSWITCH build and configuration have mod_rtmp disabled by default. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116571 attacked?: It is attacked over the network.
Am I affected by CVE-2026-116571?: Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.11.2

Disable mod_rtmp if RTMP bridging is not required, or restrict call routing to trusted RTMP endpoints only. The stock FreeSWITCH build and configuration have mod_rtmp disabled by default.

Technical details

The rtmp_rtp2rtmpH264() function builds an AVC decoder configuration record in a fixed stack buffer by copying SPS (Sequence Parameter Set) and PPS (Picture Parameter Set) parameter values from untrusted network input without validating their sizes. An established H.264 call bridged toward an RTMP endpoint can supply oversized SPS/PPS values to trigger the stack buffer overflow. The vulnerability affects only deployments that load mod_rtmp and bridge RTP media to RTMP, with the module disabled in stock builds; exploitation requires an existing call and network access to influence the H.264 parameter sets.

Affected products

SignalWire FreeSWITCH prior to 1.11.2

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.