CVE-2026-116569 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, msrp_parse_buffer() subtracted delimiter framing from a peer-controlled short segment whose MSRP byte range ended in * without first proving the segment was long enough. The unsigned result wrapped near SIZE_MAX and reached switch_msrp_msg_set_payload() as both an allocation size and memcpy length, while related pointer arithmetic could read before the receive buffer. The listener is disabled by default in msrp.conf.xml, but any deployment enabling an MSRP TCP or TLS port parses this framing before authentication. An unauthenticated network peer can corrupt memory and crash FreeSWITCH, dropping all active calls, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a comprehensive software-defined telecommunication stack designed to facilitate the migration from proprietary hardware switches to flexible software implementations running on commodity hardware. Within this architecture, the Media Server Resource Protocol (MSRP) plays a critical role in facilitating real-time text and file transfers between endpoints. The vulnerability identified affects versions of FreeSWitch prior to 1.11.2 and resides specifically within the msrp_parse_buffer function. This component is responsible for parsing incoming MSRP messages, which involves handling delimiter framing that defines the boundaries of message segments received from peers.
The core technical flaw stems from an improper validation of input data length before performing arithmetic operations on buffer pointers. Specifically, when processing a peer-controlled short segment where the MSRP byte range ends with an asterisk character, the function subtracts the delimiter framing without first verifying that the segment is sufficiently long to accommodate this operation. Because the calculation involves unsigned integer types, the subtraction of a value larger than the available data results in an underflow condition. This causes the resulting size variable to wrap around near SIZE_MAX, which represents the maximum possible value for an unsigned integer type on most systems.
This erroneous large value is subsequently passed as both the allocation size and the memcpy length parameter to switch_msrp_msg_set_payload(). Consequently, the system attempts to allocate a massive amount of memory or perform a copy operation with an excessively long byte count based on corrupted pointer arithmetic. This logic error allows for potential out-of-bounds reads before the receive buffer boundary, leading to severe memory corruption. The exploitation of this flaw can result in application crashes, effectively causing denial of service by dropping all active calls handled by the FreeSWITCH instance. While remote code execution has not been definitively demonstrated due to the complexity of exploiting such a specific integer underflow in this context, the potential for arbitrary memory access remains a significant security concern.
From an operational perspective, the risk profile is influenced by default configuration settings. The MSRP listener is disabled by default in the msrp.conf.xml configuration file, which mitigates exposure for many standard deployments. However, any organization that explicitly enables an MSRP TCP or TLS port exposes itself to this vulnerability because the parsing of framing occurs before authentication checks are performed. This means that unauthenticated network peers can trigger the vulnerable code path simply by sending a crafted MSRP message segment. The ability to crash the service remotely without prior authentication highlights a critical failure in input validation and boundary checking during early-stage packet processing.
This vulnerability aligns with CWE-190, which describes Integer Overflow or Wraparound, as well as CWE-787, Out-of-bounds Write, due to the potential for memory corruption resulting from incorrect size calculations. In terms of attack vectors, it relates to MITRE ATT&CK techniques involving resource exhaustion and denial of service through application layer exploitation. The lack of authentication prior to parsing underscores issues related to improper input validation in untrusted data handling scenarios.
To mitigate this risk, organizations running FreeSWITCH must upgrade to version 1.11.2 or later, where the integer underflow has been corrected by adding proper length checks before arithmetic operations. For deployments that cannot immediately patch due to operational constraints, it is imperative to ensure that MSRP listeners remain disabled in the configuration unless strictly necessary for business functions. If MSRP functionality is required, network-level access controls such as firewalls should be implemented to restrict inbound connections on MSRP ports to trusted IP addresses only. This defense-in-depth approach reduces the attack surface by preventing unauthenticated external actors from reaching the vulnerable parsing logic. Regular security audits of telecommunication infrastructure configurations are recommended to ensure that unnecessary services remain disabled and that all software components are kept up to date with vendor-released patches addressing known vulnerabilities.