CVE-2026-49841 is a critical heap-based buffer overflow vulnerability in the mod_verto HTTP request handler of FreeSWITCH, a software-defined telecom stack. The flaw arises because the handler allocates a fixed 2 MiB buffer for POST application/x-www-form-urlencoded bodies but processes input based on the Content-Length header, which can specify sizes up to nearly 10 MiB. This mismatch allows an attacker to overflow the heap by roughly 8 MiB before the HTTP basic authentication is performed. The vulnerability affects all FreeSWITCH versions prior to 1.11.1 and has been addressed by a patch in version 1.11.1.

Successful exploitation can lead to a heap-based buffer overflow, potentially allowing an attacker to execute arbitrary code, cause denial of service, or crash the application. The vulnerability is exploitable remotely without authentication, as the overflow occurs before the HTTP basic-auth check. The CVSS score of 9.8 reflects the critical severity and the high impact on confidentiality, integrity, and availability.

Upgrade FreeSWITCH to version 1.11.1 or later, where this vulnerability has been patched. No other official remediation or temporary fixes are documented. Applying this update will prevent exploitation of the heap overflow.