CVE-2026-116787High· 7.5▾ TwilightFreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthentica…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, mod_event_socket used an unauthenticated Content-Length value directly as the allocation size for an Event Socket message body. Negative or extremely large values could overflow the terminator calculation or force an allocation failure through a helper that aborts the FreeSWITCH process. The header is parsed before the Event Socket password, so any host admitted by apply-inbound-acl can trigger termination with its first packet; the default loopback ACL limits ordinary installations to local clients. The outbound socket dialplan path is also affected when FreeSWITCH connects to a hostile application server, and process termination drops every active call until the service is restarted. This issue is fixed in version 1.11.2.
freeswitch < 1.11.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116568High· 7.5FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
CVE-2026-116572Medium· 6.5FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name
CVE-2026-116573Medium· 6.5FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user
CVE-2026-116784High· 7.5FreeSWITCH: Out-of-bounds read in RTCP NACK feedback parsing
CVE-2026-116782High· 7.5FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
CVE-2026-116783High· 8.2FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data