FreeSwitch suffers an out-of-bounds read in the mod_rtmp H.264 video parser; an attacker can send a crafted RTMP packet that causes the parser to read beyond the buffer, leading to a crash of the FreeSwitch process. The vulnerability does not provide a write primitive or demonstrable memory disclosure, so its primary effect is to terminate the application and all active calls.

Systems running FreeSwitch versions prior to 1.11.2, especially those with the mod_rtmp module enabled and listening on the default RTMP port 1935, are affected. Deployments where RTMP accepts video calls—whether directory login is required (auth-calls true) or not—are vulnerable. The faulty parser resides in the rtmp_rtmp2rtpH264() function which is invoked for inbound H.264 NAL units.

The CVSS score of 7.5 indicates a high impact vulnerability. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, but the flaw remains actively exploitable via network traffic on port 1935. A remote attacker can trigger a denial-of-service; if auth-calls is enabled, credentials must be supplied, otherwise the vulnerability can be leveraged without authentication. The lack of covert write or disclosure limits the threat to service disruption only.