CVE-2026-116568

In FreeSWITCH prior to 1.11.2, dtls_state_setup() compares the peer certificate with the SDP a=fingerprint only when FreeSWITCH is the DTLS client, not when it is the DTLS server. An unauthenticated peer can complete the DTLS-SRTP handshake with an unrelated certificate, obtain SRTP keys, and inject media.

In FreeSWITCH prior to 1.11.2, an integer underflow in switch_xml_decode() causes an undersized heap allocation when an XML document declares an entity with an empty replacement value, and subsequent copying overruns the buffer.

In FreeSWITCH prior to 1.11.2, mod_event_socket uses an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values can overflow the terminator calculation or force an allocation failure that aborts the process.

In FreeSWITCH prior to 1.11.2, sofia_handle_sip_i_refer() places raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). A comma in the attacker-controlled value is treated as a variable separator, allowing an authenticated caller to inject arbitrary variables into a newly originated leg.

In FreeSWITCH prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw.

In FreeSWITCH prior to 1.11.2, udptl_rx_packet() used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a mod_spandsp T.38 session. A larger count wrote sender-controlled error-recovery data beyond those arrays and persisted the oversized count for a later reconstruction pass. Any peer able to deliver UDPTL to an established T.38 fax session can reach the parser.

In FreeSWITCH prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration.

In FreeSWITCH prior to 1.11.2, http_directory_auth() rebuilt an expected user@domain:password credential and base64-encoded it into an 80-byte buffer using an encoder without an output-length argument. A configured credential longer than 57 characters overflowed the stack before the supplied HTTP Basic password was compared. An unauthenticated client only needed to name an existing directory user on an exposed mod_xml_rpc HTTP listener; the module is built but not loaded by the stock configuration.

In FreeSWITCH prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer-controlled short segment whose MSRP byte range ended in * without first proving the segment was long enough. The unsigned result wrapped near SIZE_MAX and reached switch_msrp_msg_set_payload() as both an allocation size and memcpy length, while related pointer arithmetic could read before the receive buffer. The listener is disabled by default in msrp.conf.xml, but any deployment enabling an MSRP TCP or TLS port parses this framing before authentication.

In FreeSWITCH before 1.11.2, rtmp_handle_control() renders an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A body of roughly 70 bytes or more overflows the stack before any RTMP login, because the handshake authenticates neither side. The flaw affects deployments that build and load mod_rtmp, which is disabled in the stock build but commonly exposes a listener on TCP port 1935 when enabled.