CVE-2026-110658: Out-of-bounds Read in freeswitch sofia-sip

CVE-2026-110658 is a heap out-of-bounds read vulnerability in the Sofia-SIP library (up to version 1.13.18) used by FreeSWITCH. The vulnerability exists in the msg_multipart_parse() function, which improperly handles MIME boundaries in multipart Content-Type headers. An attacker can exploit this by sending an INVITE request with a boundary string longer than the actual body length, causing memcmp to read past the heap buffer and crash the process. This is a denial-of-service condition triggered remotely without authentication.

Successful exploitation results in a denial-of-service (DoS) by crashing the affected process. There is no indication of code execution or data leakage from the provided information. The attack requires no privileges or user interaction and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level protections such as filtering or rate-limiting INVITE requests with suspicious multipart Content-Type headers to mitigate potential crashes.