CVE-2026-116780
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In FreeSWITCH before 1.11.2, switch_event_expand_headers_check() advances beyond its heap copy when a positive offset in ${variable:offset} exceeds the variable value's length. The subsequent length calculation and copy append adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable via configuration templates that slice remote input and via authenticated Event Socket eval or expand commands.
Risk Assessment
Sensitive data such as credentials and pointer bytes may be disclosed through remote or authenticated vectors. Disclosure stops at a zero byte, but repeated expansion can influence memory layout.
Recommendation
Upgrade FreeSWITCH to version 1.11.2 or later. Restrict Event Socket access and audit configuration templates that slice remote input.
Other vulnerabilities in FreeSWITCH
See all- CVE-2026-116790Critical
Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepts every connectivity check without cryptographically validating the STUN MESSAGE-INTEGRITY attribute. A network peer can forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path, enabling eavesdropping and media injection on unencrypted legs.
- CVE-2026-116785Critical
Prior to 1.11.2, FreeSWITCH's ws_read_frame() decodes a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap and narrows the result into a signed length. A value whose surviving low word becomes negative bypasses the signed size check and is reinterpreted as an enormous unsigned count, causing client bytes to overwrite memory beyond the 64 KiB receive buffer. This can corrupt connection pointers and crash FreeSWITCH, ending all concurrent sessions.
- CVE-2026-116779CriticalActively exploited
Prior to 1.11.3, FreeSWITCH's sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on a plus sign and treats the left side as a chat protocol selector. Selecting the api chat proto reaches switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Exploitation has been observed in the wild.
- CVE-2026-49841Critical
FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.
- CVE-2026-49840Critical
In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.
- CVE-2026-116789High
In FreeSWITCH prior to 1.11.2, dtls_state_setup() compares the peer certificate with the SDP a=fingerprint only when FreeSWITCH is the DTLS client, not when it is the DTLS server. An unauthenticated peer can complete the DTLS-SRTP handshake with an unrelated certificate, obtain SRTP keys, and inject media.
- CVE-2026-116788High
In FreeSWITCH prior to 1.11.2, an integer underflow in switch_xml_decode() causes an undersized heap allocation when an XML document declares an entity with an empty replacement value, and subsequent copying overruns the buffer.
- CVE-2026-116787High
In FreeSWITCH prior to 1.11.2, mod_event_socket uses an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values can overflow the terminator calculation or force an allocation failure that aborts the process.
- CVE-2026-116786High
In FreeSWITCH prior to 1.11.2, sofia_handle_sip_i_refer() places raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). A comma in the attacker-controlled value is treated as a variable separator, allowing an authenticated caller to inject arbitrary variables into a newly originated leg.
- CVE-2026-116784High
In FreeSWITCH prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw.
Original NVD description (English source)
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value's length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS