CVE-2026-115928
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
In FreeSWITCH before 1.11.2, switch_core_media_add_crypto() passes the encoded key and salt length from an inbound SDP a=crypto attribute to switch_b64_decode() as the destination capacity. A zero-length key and salt makes that capacity underflow, allowing the decoded attribute to overflow a fixed stack buffer with sender-chosen bytes before the call is answered. On the shipped external profile, an unauthenticated caller can reach the SDES-SRTP parser.
Risk Assessment
The overflow corrupts memory and can crash the FreeSWITCH process, dropping every active call. Remote code execution has not been demonstrated, but service stability is at risk.
Recommendation
Upgrade FreeSWITCH to version 1.11.2 or later. As a workaround, set rtp_secure_media_inbound to false to remove the vulnerable path.
Other vulnerabilities in FreeSWITCH
See all- CVE-2026-116790Critical
Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepts every connectivity check without cryptographically validating the STUN MESSAGE-INTEGRITY attribute. A network peer can forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path, enabling eavesdropping and media injection on unencrypted legs.
- CVE-2026-116785Critical
Prior to 1.11.2, FreeSWITCH's ws_read_frame() decodes a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap and narrows the result into a signed length. A value whose surviving low word becomes negative bypasses the signed size check and is reinterpreted as an enormous unsigned count, causing client bytes to overwrite memory beyond the 64 KiB receive buffer. This can corrupt connection pointers and crash FreeSWITCH, ending all concurrent sessions.
- CVE-2026-116779CriticalActively exploited
Prior to 1.11.3, FreeSWITCH's sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on a plus sign and treats the left side as a chat protocol selector. Selecting the api chat proto reaches switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Exploitation has been observed in the wild.
- CVE-2026-49841Critical
FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.
- CVE-2026-49840Critical
In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.
- CVE-2026-116789High
In FreeSWITCH prior to 1.11.2, dtls_state_setup() compares the peer certificate with the SDP a=fingerprint only when FreeSWITCH is the DTLS client, not when it is the DTLS server. An unauthenticated peer can complete the DTLS-SRTP handshake with an unrelated certificate, obtain SRTP keys, and inject media.
- CVE-2026-116788High
In FreeSWITCH prior to 1.11.2, an integer underflow in switch_xml_decode() causes an undersized heap allocation when an XML document declares an entity with an empty replacement value, and subsequent copying overruns the buffer.
- CVE-2026-116787High
In FreeSWITCH prior to 1.11.2, mod_event_socket uses an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values can overflow the terminator calculation or force an allocation failure that aborts the process.
- CVE-2026-116786High
In FreeSWITCH prior to 1.11.2, sofia_handle_sip_i_refer() places raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). A comma in the attacker-controlled value is treated as a variable separator, allowing an authenticated caller to inject arbitrary variables into a newly originated leg.
- CVE-2026-116784High
In FreeSWITCH prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw.
Original NVD description (English source)
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_core_media_add_crypto() passed the encoded key and salt length from an inbound SDP a=crypto attribute to switch_b64_decode() as the destination capacity. A zero-length key and salt made that capacity underflow, allowing the decoded attribute to overflow a fixed stack buffer with sender-chosen bytes before the call was answered. On the shipped external profile, an unauthenticated caller can reach the SDES-SRTP parser, while profiles that challenge inbound calls remain affected for senders who can authenticate; setting rtp_secure_media_inbound to false removes the path, and WebRTC DTLS-SRTP legs are unaffected. The overflow corrupts memory and can crash the FreeSWITCH process, dropping every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS