Stack-based buffer overflow in freeswitch - CVE-2026-116570
Published: November 9, 2026
Vulnerability identifier: #VU162778
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116570
CWE-ID: CWE-121
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to crash FreeSWITCH and terminate all active calls.
The vulnerability exists due to a stack buffer overflow during credential encoding in the opt-in mod_xml_rpc HTTP authentication component when a configured user@domain:password exceeds 57 characters. An unauthenticated remote attacker can send an HTTP Basic authentication request naming an existing directory user to the exposed module listener without knowing the password, triggering the overflow before authentication.
Affected software
freeswitch
How to mitigate CVE-2026-116570
Install security update from vendor's website.
freeswitch - update to 1.11.2