Out-of-bounds write in freeswitch - CVE-2026-116781
Published: November 9, 2026
Vulnerability identifier: #VU162788
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116781
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to corrupt outbound data queued for their own FreeSWITCH connection.
The vulnerability exists due to incorrect payload bounds during WebSocket frame unmasking in mod_xml_rpc, when the module is loaded and enable-websocket is enabled in xml_rpc.conf.xml. An unauthenticated remote attacker can upgrade a connection at /socket and send a masked frame filling the receive buffer before authentication, corrupting up to 14 bytes beyond it.
Affected software
freeswitch
How to mitigate CVE-2026-116781
Install security update from vendor's website.
freeswitch - update to 1.11.2