FreeSWITCH includes mod_rtmp, which can bridge RTP media to an RTMP endpoint. In versions prior to 1.11.2, the rtmp_rtp2rtmpH264() function constructs an AVC decoder configuration record by copying SPS and PPS data received over the network into a fixed‑size stack buffer without validating the length or framing. This oversight creates a stack buffer overflow that can corrupt the function’s stack frame. The overflow can trigger a crash that aborts the FreeSWITCH process and terminates all active calls, and on builds without stack protection may provide a limited stack‑write primitive, although code execution has not been demonstrated. The likely attack vector is an established H.264 call that bridges RTP traffic to an RTMP leg where an attacker supplies oversized SPS and PPS parameter sets.

The vulnerability affects installations of the SignalWire FreeSWITCH build that include the mod_rtmp module and use RTP-to-RTMP bridging. The default stock configuration disables mod_rtmp, so unmodified stock deployments are not affected. Versions released before 1.11.2 are vulnerable when the module is enabled or loaded, and any custom build that compiles and loads mod_rtmp with bridging capabilities faces the risk.

This flaw carries a medium CVSS score of 5.9. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating that mass exploitation has not been observed. Nevertheless, the overflow can cause a crash that terminates active sessions, representing a significant availability impact. An attacker can exploit the flaw by initiating an H.264 call that bridges RTP traffic to a configured RTMP endpoint, sending oversized SPS and PPS data. While the data shows a limited stack‑write primitive on builds without stack protection, no successful code‑execution exploit has been reported. The risk is mitigated for deployments that disable mod_rtmp or never load the module.