---
id: CVE-2026-116788
title: >-
  FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity
  decoding
summary: "FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in \_switch_xml_decode()\_ can cause an undersized heap allocation when an XML document declares an entity with an empty replace…"
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H'
cvssSource: cna
cwe:
  - CWE-122
  - CWE-131
  - CWE-191
vendor: signalwire
product: freeswitch
affected:
  - freeswitch < 1.11.2
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:39:44.929Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116788'
references:
  - url: >-
      https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3
    label: >-
      https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3
  - url: >-
      https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01
    label: >-
      https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01
  - url: 'https://github.com/signalwire/freeswitch/releases/tag/v1.11.2'
    label: 'https://github.com/signalwire/freeswitch/releases/tag/v1.11.2'
tags:
  - cve.org
ingestedAt: '2026-11-05T22:38:31.555Z'
---

## Overview

FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in  switch_xml_decode()  can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.

## Affected

- `freeswitch < 1.11.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.