CVE-2026-116569

In FreeSWITCH prior to 1.11.2, dtls_state_setup() compares the peer certificate with the SDP a=fingerprint only when FreeSWITCH is the DTLS client, not when it is the DTLS server. An unauthenticated peer can complete the DTLS-SRTP handshake with an unrelated certificate, obtain SRTP keys, and inject media.

In FreeSWITCH prior to 1.11.2, an integer underflow in switch_xml_decode() causes an undersized heap allocation when an XML document declares an entity with an empty replacement value, and subsequent copying overruns the buffer.

In FreeSWITCH prior to 1.11.2, mod_event_socket uses an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values can overflow the terminator calculation or force an allocation failure that aborts the process.

In FreeSWITCH prior to 1.11.2, sofia_handle_sip_i_refer() places raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). A comma in the attacker-controlled value is treated as a variable separator, allowing an authenticated caller to inject arbitrary variables into a newly originated leg.

In FreeSWITCH prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw.

In FreeSWITCH prior to 1.11.2, udptl_rx_packet() used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a mod_spandsp T.38 session. A larger count wrote sender-controlled error-recovery data beyond those arrays and persisted the oversized count for a later reconstruction pass. Any peer able to deliver UDPTL to an established T.38 fax session can reach the parser.

In FreeSWITCH prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration.

In FreeSWITCH prior to 1.11.2, http_directory_auth() rebuilt an expected user@domain:password credential and base64-encoded it into an 80-byte buffer using an encoder without an output-length argument. A configured credential longer than 57 characters overflowed the stack before the supplied HTTP Basic password was compared. An unauthenticated client only needed to name an existing directory user on an exposed mod_xml_rpc HTTP listener; the module is built but not loaded by the stock configuration.

In FreeSWITCH prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false.

In FreeSWITCH before 1.11.2, rtmp_handle_control() renders an RTMP user-control message into a 200-byte stack buffer using an unbounded sprintf loop controlled by the wire message length. A body of roughly 70 bytes or more overflows the stack before any RTMP login, because the handshake authenticates neither side. The flaw affects deployments that build and load mod_rtmp, which is disabled in the stock build but commonly exposes a listener on TCP port 1935 when enabled.