FreeSWITCH is susceptible to a stack-based buffer overflow triggered by an RTMP control message received before authentication. The unbounded sprintf loop writes a 200‑byte buffer with the message data, and a body of roughly 70 bytes or more overflows the stack. When this occurs, FreeSWITCH crashes and terminates all active calls. No direct control‑flow hijacking has been demonstrated; the effect is limited to denial of service.

SignalWire's FreeSWITCH product, versions prior to 1.11.2, when compiled with the mod_rtmp module enabled. The vulnerable module typically listens on TCP port 1935, a port commonly used for RTMP traffic.

The vulnerability has a CVSS score of 7.5, classifying it as high severity. EPSS data is not available, and it is not yet listed in CISA's KEV catalog. The flaw can be triggered by any remote host that can send an untrusted RTMP control message before the TLS/RTMP handshake completes, making it accessible without authentication. Attackers can invoke the overflow to force a crash and disrupt services. Because no memory corruption that leads to code execution has been reported, the risk is confined to service interruption rather than full compromise.