FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTMP connect argument to amf0_object_get() without checking whether the AMF value was an object. A string or number in place of an AMF object caused union bytes from the message to be interpreted as node pointers and dereferenced. Any client with network access to an enabled mod_rtmp listener could send the malformed connect command before login; the module is disabled in the stock build and configuration. The invalid read reliably crashes FreeSWITCH and ends every active call, while no write, memory disclosure, or code execution has been demonstrated. This issue is fixed in version 1.11.2.
CVE-2026-116783 is a high-severity vulnerability in FreeSWITCH prior to version 1.11.2. It involves improper validation of an array index in the udptl_rx_packet() function within the mod_spandsp T.38 fax session handler. A peer can send a larger-than-expected FEC entry count, causing memory corruption by writing beyond fixed-size arrays. This can crash FreeSWITCH and terminate all active calls. Remote code execution has not been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116790 is an authentication bypass vulnerability in FreeSWITCH prior to version 1.11.2. The flaw involves the inbound ICE handling accepting all connectivity checks without verifying the STUN MESSAGE-INTEGRITY attribute cryptographically. This allows an attacker on the network to spoof ICE connectivity checks, nominate their own address, redirect RTP and DTLS traffic, and terminate the legitimate media path. Unencrypted media legs are vulnerable to eavesdropping and media injection. The issue affects all WebRTC and SIP legs that negotiate ICE. The vulnerability is fixed in FreeSWITCH version 1.11.2 by enabling ice_verify_message_integrity=true.
CVE-2026-116788 is a heap-based buffer overflow vulnerability in FreeSWITCH before version 1.11.2. It arises from an integer underflow in the switch_xml_decode() function when processing XML documents with entities that have empty replacement values. An unauthenticated attacker can exploit this by sending a crafted SIP PUBLISH request to a SIP profile with presence management and DTD processing enabled, causing heap memory corruption and process termination, disrupting active calls. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116780 is an out-of-bounds read vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the function switch_event_expand_headers_check() when a positive offset in variable expansion exceeds the variable's length, causing adjacent heap memory to be appended to the expansion result. This can lead to unintended disclosure of sensitive data such as channel variables, credentials, allocator data, and pointer bytes. The vulnerability is exploitable through configuration templates or authenticated Event Socket commands but not through ordinary dialplan slicing. The issue is fixed in FreeSWITCH version 1.11.2.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, process_rtcp_report() used an RTPFB NACK packet's declared RTCP header length as its feedback-entry loop bound instead of the datagram length already validated by the caller. A short packet with an oversized declaration could drive reads far beyond the fixed 16 KiB receive buffer. Any peer able to send RTCP to an active video call can reach the flaw, including calls where remote SDP enables video RTCP even though the SIP profile has no explicit RTCP interval configured. The out-of-bounds read can crash FreeSWITCH and terminate every active call, but supplies no write primitive and does not echo the read values to the sender. This issue is fixed in version 1.11.2.
CVE-2026-116779 is a critical command injection vulnerability in SignalWire FreeSWITCH prior to version 1.11.3. The flaw arises from improper handling of inbound SIP MESSAGE requests, allowing an attacker with an authenticated profile to execute arbitrary FreeSWITCH API commands, including operating system commands, with daemon privileges. This can lead to configuration disclosure, arbitrary call control, and full command execution. The vulnerability is fixed in FreeSWITCH version 1.11.3.
CVE-2026-116789 is an improper certificate validation vulnerability in SignalWire FreeSWITCH versions prior to 1.11.2. The flaw occurs because FreeSWITCH did not validate the DTLS peer certificate against the SDP fingerprint when acting as a DTLS server, allowing an unauthenticated peer to complete the DTLS-SRTP handshake with an unrelated certificate. This enables the attacker to obtain SRTP keys, decrypt and inject media, and displace the legitimate endpoint. The issue affects WebRTC and SIP DTLS-SRTP legs when the peer selects the active role. Version 1.11.2 fixes this by requiring fingerprint verification via the configuration parameter rtp_dtls_client_cert_verify_mode=fingerprint.
CVE-2026-116781 is an off-by-one error vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the ws_read_frame() function when unmasking WebSocket payloads, potentially causing writes up to 14 bytes beyond the receive buffer and a terminating NUL byte one byte out of bounds. This vulnerability is reachable before authentication if mod_xml_rpc and its WebSocket endpoint are enabled, though these features are disabled by default. The out-of-bounds writes remain within the same connection handle's adjacent outbound buffer, and no process crash or cross-session data disclosure has been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116785 is a heap-based buffer overflow vulnerability in FreeSWITCH prior to version 1.11.2. The flaw arises from improper handling of a WebSocket frame's extended payload length in the ws_read_frame() function, which leads to memory overwrite beyond the allocated receive buffer. This vulnerability can cause FreeSWITCH to crash, terminating all concurrent sessions. The vulnerable code path is reachable before HTTP authentication on the mod_xml_rpc WebSocket endpoint, which is disabled by default. Remote code execution has not been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116786 is a command injection vulnerability in SignalWire FreeSWITCH prior to version 1.11.2. The flaw exists in the sofia_handle_sip_i_refer() function, which improperly handles Refer-To URI parameters and headers, allowing an authenticated caller to inject arbitrary variables into a new call leg. This can lead to execution of operating system commands with FreeSWITCH process privileges. The vulnerability requires only a registered SIP account and a call that uses the off-box transfer path. It is fixed in version 1.11.2.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
CVE-2026-116567 is a stack-based buffer overflow vulnerability in FreeSWITCH's mod_rtmp module prior to version 1.11.2. The flaw occurs in the rtmp_handle_control() function, which uses an unbounded sprintf loop to render RTMP user-control messages into a fixed 200-byte stack buffer. Messages with a body of roughly 70 bytes or more can overflow the stack before any RTMP login, potentially crashing FreeSWITCH and terminating all active calls. The vulnerability requires no authentication and affects deployments that enable mod_rtmp, which is disabled by default. This issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116571 is a stack-based buffer overflow vulnerability in FreeSWITCH's mod_rtmp module prior to version 1.11.2. The flaw occurs in the rtmp_rtp2rtmpH264() function, which copies SPS and PPS values into a fixed stack buffer without validating their size, allowing an attacker to overflow the stack. This vulnerability affects only deployments that enable mod_rtmp and bridge RTP media into an RTMP leg, which is disabled by default. Exploitation can cause FreeSWITCH to abort and terminate all active calls. While code execution has not been demonstrated, builds lacking stack protection may allow limited stack writes. The issue is fixed in version 1.11.2.
CVE-2026-116570 is a stack-based buffer overflow vulnerability in FreeSWITCH versions prior to 1.11.2. The flaw occurs in the http_directory_auth() function, which encodes user credentials into a fixed 80-byte buffer without checking output length. Credentials longer than 57 characters can overflow the stack, potentially crashing FreeSWITCH and disrupting active calls. Exploitation requires only an unauthenticated client to specify an existing directory user on an exposed mod_xml_rpc HTTP listener, though this module is not loaded by default. Remote code execution has not been demonstrated. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116569 is an integer underflow vulnerability in FreeSWITCH prior to version 1.11.2. The flaw occurs in the msrp_parse_buffer() function, which subtracts delimiter framing from a peer-controlled short segment without verifying its length, causing an unsigned integer wraparound. This leads to memory corruption and potential crashes when processing MSRP TCP or TLS connections before authentication. The listener is disabled by default, but enabling MSRP ports exposes this risk. The issue is fixed in FreeSWITCH version 1.11.2.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_rtmp2rtpH264() trusted the length prefix of each inbound H.264 NAL unit without checking it against the bytes remaining in the RTMP message. An oversized declared unit underflowed the unsigned remaining-byte counter and advanced the parser beyond its receive buffer, where the next length-prefix read could crash the process. The flaw affects deployments that build and load mod_rtmp and accept video call sessions, commonly on TCP port 1935; placing the call requires a directory login where auth-calls is true, while no credentials are required where auth-calls is absent or false. A remote client can terminate FreeSWITCH and every active call, but the defect supplies no write primitive and memory disclosure has not been demonstrated. This issue is fixed in version 1.11.2.
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in mod_sofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed 512-byte stack buffer. Exploitation requires presence management to be enabled, directly or through shared appearance, and normally requires valid profile credentials unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
CVE-2026-115928 is a stack-based buffer overflow vulnerability in FreeSWITCH prior to version 1.11.2. It occurs in the function switch_core_media_add_crypto() when processing the encoded key and salt length from an inbound SDP a=crypto attribute. A zero-length key and salt cause an underflow in the destination capacity, leading to a buffer overflow on the stack. This overflow can corrupt memory and crash the FreeSWITCH process, dropping all active calls. The vulnerability affects the shipped external profile accessible to unauthenticated callers and authenticated inbound calls on other profiles unless mitigated by configuration. The issue is fixed in FreeSWITCH version 1.11.2.
CVE-2026-116574 is an off-by-one error vulnerability in FreeSWITCH prior to version 1.11.2. The function switch_xml_ampencode() reserved insufficient space for a terminating NUL byte when encoding four-byte UTF-8 sequences, causing a one-byte heap overflow when serializing remote-supplied text at a buffer boundary. This flaw affects multiple XML serialization outputs that handle caller-controlled values. The issue can cause process aborts or memory corruption but has not been shown to enable remote code execution. The vulnerability is fixed in FreeSWITCH version 1.11.2.