{"id":"CVE-2026-116788","title":"FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding","summary":"FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replace…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-122","CWE-131","CWE-191"],"vendor":"signalwire","product":"freeswitch","affected":["freeswitch < 1.11.2"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T19:39:44.929Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116788","references":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3","label":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3"},{"url":"https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01","label":"https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01"},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2","label":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.2"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T22:38:31.555Z","slug":"CVE-2026-116788","body":"## Overview\n\nFreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.\n\n## Affected\n\n- `freeswitch < 1.11.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}