CVE-2026-116572 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in mod_sofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed 512-byte stack buffer. Exploitation requires presence management to be enabled, directly or through shared appearance, and normally requires valid profile credentials unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a widely deployed open-source telecommunications platform designed to handle voice, video, and messaging protocols within enterprise and carrier-grade environments. Within versions ranging from 1.10.0 through 1.11.1, the mod_sofia module contains a critical stack-based buffer overflow vulnerability that affects the processing of Session Initiation Protocol Contact display names during dialog-event notifications. This flaw arises when the application attempts to store or manipulate contact information associated with SIP dialogs without performing adequate bounds checking on the length of the input data. Specifically, an attacker can craft a malicious SIP message containing a Display-Name field that exceeds the fixed 512-byte buffer allocated in the stack memory space used by mod_sofia for this purpose.
The technical mechanism of exploitation relies on the interaction between presence management features and dialog event subscriptions. To successfully trigger the overflow, an adversary must first establish a SIP dialog with FreeSWITCH using a contact header that includes an excessively long display name string. Once this state is established, the attacker subscribes to dialog events for that specific entity. When the system processes these notifications, it copies the stored display name into the fixed-size stack buffer without verifying if the data fits within the allocated memory limits. This lack of input validation leads directly to a stack-based buffer overflow, where excess bytes overwrite adjacent memory locations on the call stack, potentially overwriting return addresses or other critical control data structures.
The operational impact of this vulnerability is severe and immediate for any affected FreeSWITCH deployment. Successful exploitation allows an unauthenticated attacker, provided that presence management is enabled either directly or through shared appearance mechanisms, to cause a denial of service by terminating the FreeSWITCH process entirely. Because FreeSWITCH typically handles multiple concurrent sessions within a single process instance, this crash results in the abrupt termination of all active calls and services running on that server node. This leads to significant service disruption for end-users relying on voice or video communications through the platform. While exploitation generally requires valid profile credentials due to authentication requirements, it can be achieved more easily if subscription authentication is disabled within the configuration, lowering the barrier to entry for attackers targeting less secure deployments.
From a classification perspective, this vulnerability aligns with CWE-121, which describes stack-based buffer overflow conditions resulting from insufficient bounds checking on user-supplied input. In terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates remote code execution or denial-of-service capabilities through technique T1498, Network Denial of Service, and potentially T1059 if the overwritten stack data allows for arbitrary command execution depending on compiler protections like ASLR and DEP. The vulnerability highlights the importance of rigorous input validation in network-facing services that parse complex protocol headers.
Mitigation strategies focus primarily on upgrading to version 1.11.2 or later, where the developers have implemented proper length checks before copying data into the stack buffer. For organizations unable to immediately patch their systems due to operational constraints, temporary mitigations include disabling presence management features if they are not strictly required for business operations. Additionally, administrators should ensure that subscription authentication is enabled and enforced to prevent unauthenticated actors from establishing the necessary dialog states or subscribing to events. Network-level controls such as deep packet inspection firewalls may also help detect and block SIP messages with abnormally large header fields before they reach the vulnerable application layer, providing an additional defense-in-depth measure against exploitation attempts.