SB2026110995 - Multiple vulnerabilities in freeswitch

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110995

SB2026110995 - Multiple vulnerabilities in freeswitch

Published: November 9, 2026

Security Bulletin ID SB2026110995
CSH Severity
High
Patch available
YES
Number of vulnerabilities 22
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 23% Medium 59% Low 18%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 22 vulnerabilities.


1) Stack-based buffer overflow (CVE-ID: CVE-2026-115928)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and drop all calls handled by the process.

The vulnerability exists due to incorrect bounds handling in the SDP crypto parser, allowing a zero-length key and salt to trigger a stack buffer overflow. An unauthenticated remote attacker can send a crafted SIP INVITE offering SRTP to a profile accepting unauthenticated inbound calls, triggering memory corruption before the call is answered.


2) Resource exhaustion (CVE-ID: CVE-2026-119292)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to cause one-way audio loss in FreeSWITCH calls, making conversation unusable while signaling remains established.

The vulnerability exists due to delayed source validation in FreeSWITCH RTP/SRTP handling, allowing packets from unrecognized sources to consume processing resources after the media peer is learned. An unauthenticated remote attacker can flood a known, UDP-reachable active media port from another source without an SRTP key, starving legitimate incoming media on calls that relay or echo it.


3) Origin validation error (CVE-ID: CVE-2026-119293)

CWE-ID: CWE-346 - Origin Validation Error

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to intercept a plaintext RTP call's audio, inject audio, and deny media to the legitimate endpoint.

The vulnerability exists due to insufficient source validation in FreeSWITCH RTP source learning when packets from an unnegotiated source reach the learning threshold during call setup. An unauthenticated remote attacker can send RTP packets before the legitimate endpoint sends media, causing FreeSWITCH to adopt the attacker's address and retain it as the media peer.


4) Heap-based buffer overflow (CVE-ID: CVE-2026-116788)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and cause denial of service.

The vulnerability exists due to a buffer size underflow in the core XML parser when decoding a DTD entity with an empty replacement value. An unauthenticated remote attacker can send a single SIP PUBLISH request containing crafted XML to a reachable profile with manage-presence enabled, triggering a heap buffer overflow before authentication.


5) Improper Certificate Validation (CVE-ID: CVE-2026-116789)

CWE-ID: CWE-295 - Improper Certificate Validation

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated network attacker to decrypt and inject call media while impersonating the legitimate endpoint.

The vulnerability exists due to missing validation of peer certificates against the SDP fingerprint when FreeSWITCH acts as the DTLS server for DTLS-SRTP. An unauthenticated network attacker can obtain SRTP keys by completing a client handshake at the negotiated media port, requiring SDP connectivity-check credentials as well on ICE-enabled legs.


6) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-116790)

CWE-ID: CWE-290 - Authentication Bypass by Spoofing

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to redirect media and disrupt active ICE-enabled FreeSWITCH calls.

The vulnerability exists due to missing STUN MESSAGE-INTEGRITY verification in FreeSWITCH's inbound ICE handling when connectivity checks reach an active call's UDP media port. An unauthenticated remote attacker can send forged Binding Requests to that reachable port without ICE credentials, redirecting media to an attacker-controlled address and enabling eavesdropping and injection when media encryption is not negotiated.


7) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-116787)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to terminate FreeSWITCH, dropping all active calls until the service is restarted.

The vulnerability exists due to unbounded memory allocation from the Event Socket Content-Length header before authentication. An unauthenticated remote attacker can trigger fatal allocation failure with one oversized request through an address admitted by apply-inbound-acl (loopback-only by default) or an outbound application server they control.


8) Out-of-bounds read (CVE-ID: CVE-2026-116780)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a privileged remote attacker to disclose adjacent heap contents, including instance UUID fragments and raw pointer bytes.

The vulnerability exists due to missing bounds checks on positive slicing offsets in FreeSWITCH's event variable expander, causing reads beyond a variable's allocated value. A privileged remote attacker can submit out-of-range expansions through an authenticated Event Socket session when remote access is enabled, while default installations restrict this interface to localhost.


9) Out-of-bounds write (CVE-ID: CVE-2026-116781)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to corrupt outbound data queued for their own FreeSWITCH connection.

The vulnerability exists due to incorrect payload bounds during WebSocket frame unmasking in mod_xml_rpc, when the module is loaded and enable-websocket is enabled in xml_rpc.conf.xml. An unauthenticated remote attacker can upgrade a connection at /socket and send a masked frame filling the receive buffer before authentication, corrupting up to 14 bytes beyond it.


10) Heap-based buffer overflow (CVE-ID: CVE-2026-116785)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to corrupt heap memory and crash FreeSWITCH, terminating all concurrent sessions.

The vulnerability exists due to incorrect extended payload length conversion in the mod_xml_rpc WebSocket handler, allowing crafted lengths to bypass buffer bounds checks. An unauthenticated remote attacker can complete a WebSocket upgrade and send a malformed frame to trigger a heap buffer overflow when the module is loaded and its opt-in WebSocket endpoint is enabled.


11) Out-of-bounds read (CVE-ID: CVE-2026-116784)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate every call handled by the instance.

The vulnerability exists due to the RTCP NACK parser trusting a packet's declared length instead of its received size, causing an out-of-bounds read when a short packet declares an oversized length. An unauthenticated remote attacker can trigger the crash by delivering a crafted UDP datagram to the negotiated video RTCP port during an active video call with RTCP enabled.


12) Command injection (CVE-ID: CVE-2026-116786)

CWE-ID: CWE-77 - Command injection

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote authenticated attacker to execute operating system commands with the privileges of the FreeSWITCH process.

The vulnerability exists due to unescaped SIP Refer-To values entering an outbound channel-variable block in mod_sofia when REFER names an unknown dialog. A remote authenticated attacker with a registered account participating in a bridged call can inject comma-separated variables through REFER to trigger shell execution without another user's cooperation.


13) Stack-based buffer overflow (CVE-ID: CVE-2026-116567)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate all active calls when the non-default mod_rtmp module is built and loaded.

The vulnerability exists due to an unchecked write into a fixed stack buffer when mod_rtmp renders an oversized RTMP user-control message body as hexadecimal text. An unauthenticated remote attacker can send a single crafted control message to the reachable RTMP listener before login to trigger the overflow.


14) Out-of-bounds read (CVE-ID: CVE-2026-116568)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate every active call when mod_rtmp is built and loaded and auth-calls is disabled.

The vulnerability exists due to unchecked NAL unit lengths in RTMP H.264 video parsing, causing an out-of-bounds read. An unauthenticated remote attacker can establish a video call and send a malformed video message to trigger the crash, although profiles enabling auth-calls require directory user credentials first.


15) Stack-based buffer overflow (CVE-ID: CVE-2026-116571)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate all active calls.

The vulnerability exists due to missing bounds checks when the explicitly enabled mod_rtmp module builds AVC sequence headers from H.264 parameter sets during RTP-to-RTMP bridging. An unauthenticated remote attacker can send oversized parameter sets over an established call to an RTMP endpoint, subject to deployment-specific call authentication, overflowing a stack buffer and triggering process termination on stack-protected builds.


16) Integer underflow (CVE-ID: CVE-2026-116569)

CWE-ID: CWE-191 - Integer underflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash the FreeSWITCH process and drop all active calls when a non-default MSRP listener is enabled.

The vulnerability exists due to unchecked unsigned subtraction in MSRP body parsing when a short received segment contains a byte range ending in an asterisk. An unauthenticated remote attacker can send a crafted message to the reachable MSRP port, triggering an out-of-bounds write before authentication without victim interaction.


17) Stack-based buffer overflow (CVE-ID: CVE-2026-116572)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to crash FreeSWITCH and terminate every active call.

The vulnerability exists due to an unbounded copy of a stored SIP Contact display-name into a fixed stack buffer in mod_sofia on profiles with manage-presence or manage-shared-appearance enabled. A low-privileged remote attacker can establish an inbound dialog with an oversized display-name and subscribe to its dialog events to trigger the overflow, using profile credentials unless subscription authentication is disabled.


18) Stack-based buffer overflow (CVE-ID: CVE-2026-116573)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an authenticated remote attacker to crash the FreeSWITCH process and terminate every call on a stack-protected instance.

The vulnerability exists due to an unbounded copy of a stored To-header user into a stack buffer in mod_sofia when generating dialog notifications on SIP profiles with manage-presence or manage-shared-appearance enabled. An authenticated remote attacker can establish a dialog with an overlong To-header user and subscribe to its dialog events to trigger the overflow without victim interaction.


19) Stack-based buffer overflow (CVE-ID: CVE-2026-116570)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate all active calls.

The vulnerability exists due to a stack buffer overflow during credential encoding in the opt-in mod_xml_rpc HTTP authentication component when a configured user@domain:password exceeds 57 characters. An unauthenticated remote attacker can send an HTTP Basic authentication request naming an existing directory user to the exposed module listener without knowing the password, triggering the overflow before authentication.


20) Off-by-one (CVE-ID: CVE-2026-116574)

CWE-ID: CWE-193 - Off-by-one Error

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a low-privileged remote attacker to crash the FreeSWITCH process or corrupt adjacent heap data.

The vulnerability exists due to an off-by-one buffer reservation error in FreeSWITCH's XML serializer when escaping a four-byte UTF-8 sequence at a specific buffer boundary. A low-privileged remote attacker can repeatedly vary text in caller IDs or SIP headers that the deployment serializes into XML to trigger a single-byte NUL overwrite on the heap.


21) Type Confusion (CVE-ID: CVE-2026-116782)

CWE-ID: CWE-843 - Type confusion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate every call handled by the instance.

The vulnerability exists due to missing AMF type validation in mod_rtmp connect handling, causing a non-object argument to be dereferenced as an object. An unauthenticated remote attacker can send a single malformed connect command to a reachable RTMP listener when the non-default mod_rtmp module is built and loaded, triggering denial of service without victim interaction.


22) Out-of-bounds write (CVE-ID: CVE-2026-116783)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate every call on the instance.

The vulnerability exists due to an unchecked FEC entry count in the mod_spandsp UDPTL parser that permits out-of-bounds writes when processing error-recovery data. An unauthenticated remote attacker can send a malformed UDPTL packet to an established fax session's reachable media port and corrupt memory when mod_spandsp is loaded and T.38 is negotiated.


Remediation

Install update from vendor's website.

References