CVE-2026-116788High· 8.2▾ TwilightFreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replace…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.
freeswitch < 1.11.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116568High· 7.5FreeSWITCH: Out-of-bounds read in mod_rtmp H.264 video message parsing
CVE-2026-116785Critical· 9.1FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling
CVE-2026-116570High· 7.5FreeSWITCH: Pre-authentication stack buffer overflow in mod_xml_rpc HTTP directory authentication
CVE-2026-116569High· 7.5FreeSWITCH: Pre-authentication out-of-bounds write in MSRP message body parsing
CVE-2026-115928High· 7.5FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls
CVE-2026-116787High· 7.5FreeSWITCH: Pre-authentication process termination in the Event Socket via an unbounded Content-Length