CVE-2026-116781

Prior to 1.11.2, FreeSWITCH's inbound ICE handling accepts every connectivity check without cryptographically validating the STUN MESSAGE-INTEGRITY attribute. A network peer can forge an ICE connectivity check without SDP credentials, nominate its own address, redirect RTP and DTLS traffic, and terminate the legitimate media path, enabling eavesdropping and media injection on unencrypted legs.

Prior to 1.11.2, FreeSWITCH's ws_read_frame() decodes a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap and narrows the result into a signed length. A value whose surviving low word becomes negative bypasses the signed size check and is reinterpreted as an enormous unsigned count, causing client bytes to overwrite memory beyond the 64 KiB receive buffer. This can corrupt connection pointers and crash FreeSWITCH, ending all concurrent sessions.

FreeSWITCH prior to version 1.11.1 has a heap overflow vulnerability in the mod_verto module. An attacker can send an HTTP POST request with a large body, causing a buffer overflow before authentication.

In FreeSWITCH prior to version 1.11.1, esl_recv_event() mishandles Content-Length, allowing a malicious ESL peer to send a frame with a negative value, causing heap corruption or process crash before authentication.

In FreeSWITCH prior to 1.11.2, dtls_state_setup() compares the peer certificate with the SDP a=fingerprint only when FreeSWITCH is the DTLS client, not when it is the DTLS server. An unauthenticated peer can complete the DTLS-SRTP handshake with an unrelated certificate, obtain SRTP keys, and inject media.

In FreeSWITCH prior to 1.11.2, an integer underflow in switch_xml_decode() causes an undersized heap allocation when an XML document declares an entity with an empty replacement value, and subsequent copying overruns the buffer.

In FreeSWITCH prior to 1.11.2, mod_event_socket uses an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values can overflow the terminator calculation or force an allocation failure that aborts the process.

In FreeSWITCH prior to 1.11.2, sofia_handle_sip_i_refer() places raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). A comma in the attacker-controlled value is treated as a variable separator, allowing an authenticated caller to inject arbitrary variables into a newly originated leg.

In FreeSWITCH prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw.