Out-of-bounds write in freeswitch - CVE-2026-116783
Published: November 9, 2026
Vulnerability identifier: #VU162775
CSH Severity: High
CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116783
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate every call on the instance.
The vulnerability exists due to an unchecked FEC entry count in the mod_spandsp UDPTL parser that permits out-of-bounds writes when processing error-recovery data. An unauthenticated remote attacker can send a malformed UDPTL packet to an established fax session's reachable media port and corrupt memory when mod_spandsp is loaded and T.38 is negotiated.
Affected software
freeswitch
How to mitigate CVE-2026-116783
Install security update from vendor's website.
freeswitch - update to 1.11.2