Out-of-bounds read in freeswitch - CVE-2026-116780
Published: November 9, 2026
Vulnerability identifier: #VU162789
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116780
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a privileged remote attacker to disclose adjacent heap contents, including instance UUID fragments and raw pointer bytes.
The vulnerability exists due to missing bounds checks on positive slicing offsets in FreeSWITCH's event variable expander, causing reads beyond a variable's allocated value. A privileged remote attacker can submit out-of-range expansions through an authenticated Event Socket session when remote access is enabled, while default installations restrict this interface to localhost.
Affected software
freeswitch
How to mitigate CVE-2026-116780
Install security update from vendor's website.
freeswitch - update to 1.11.2