Origin validation error in freeswitch - CVE-2026-119293
Published: November 9, 2026
Vulnerability identifier: #VU162794
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119293
CWE-ID: CWE-346
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to intercept a plaintext RTP call's audio, inject audio, and deny media to the legitimate endpoint.
The vulnerability exists due to insufficient source validation in FreeSWITCH RTP source learning when packets from an unnegotiated source reach the learning threshold during call setup. An unauthenticated remote attacker can send RTP packets before the legitimate endpoint sends media, causing FreeSWITCH to adopt the attacker's address and retain it as the media peer.
Affected software
freeswitch
How to mitigate CVE-2026-119293
Install security update from vendor's website.
freeswitch - update to 1.11.2