CVE-2026-116573 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in mod_sofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified within FreeSWITCH versions ranging from 1.10.0 to 1.11.1 represents a critical stack-based buffer overflow located specifically within the mod_sofia module, which handles Session Initiation Protocol signaling and dialog management. This flaw emerges during the generation of dialog-event notifications, where the software fails to adequately validate or bound-check the length of specific SIP header fields before copying them into fixed-size memory buffers on the call stack. The technical root cause lies in the handling of the To-header user part within incoming SIP messages. When a peer establishes a dialog with an excessively long value in this field and subsequently subscribes to that entity’s dialog events, the application copies the unbounded input directly into a limited buffer without performing necessary length checks or truncation logic. This lack of boundary validation allows maliciously crafted data to exceed the allocated stack space, leading to memory corruption that overwrites adjacent stack frames and control flow data structures essential for process stability.
From an operational perspective, this vulnerability poses a severe risk to service availability and integrity. Successful exploitation requires specific configuration conditions, namely that presence or shared-appearance management features must be enabled on the FreeSWITCH instance. Furthermore, under normal security configurations, an attacker would need valid profile credentials to interact with these services. However, if subscription authentication is disabled due to misconfiguration or legacy system requirements, the attack surface expands significantly as unauthenticated actors can trigger the overflow. The immediate consequence of exploiting this buffer overflow is typically a segmentation fault that terminates the FreeSWITCH process entirely. Because FreeSWITCH often handles multiple concurrent sessions within a single process instance in many deployments, such a crash results in the abrupt termination of all active calls and services running on that node, leading to widespread denial of service for connected endpoints and potentially disrupting critical communication infrastructure dependent on this platform.
In terms of industry-standard classification frameworks, this vulnerability aligns with CWE-121, which denotes stack-based buffer overflow, a category of memory corruption errors where data written exceeds the bounds of a fixed-size buffer located in the program's call stack. The attack vector leverages SIP protocol interactions to trigger remote code execution or denial-of-service conditions, mapping closely to MITRE ATT&CK techniques related to resource hijacking and service disruption through application layer exploitation. While direct arbitrary code execution is complex due to modern mitigations like stack canaries and ASLR often present in compiled binaries, the guaranteed process crash makes this a high-severity availability vulnerability that attackers frequently exploit for disruptive impact rather than stealthy persistence.
To mitigate this risk, organizations running FreeSWITCH must immediately upgrade to version 1.11.2 or later, where the developers have implemented proper input validation and buffer size checks within mod_sofia before processing dialog-event notifications. For environments unable to patch immediately due to operational constraints, defensive measures should include enforcing strict subscription authentication policies to prevent unauthenticated access to presence services. Additionally, deploying network-level intrusion prevention systems capable of inspecting SIP traffic for anomalously long header fields can provide a layer of defense by dropping packets that exceed expected size limits before they reach the vulnerable application logic. Regular auditing of configuration settings to ensure that optional features like shared-appearance management are disabled if not strictly required further reduces the attack surface and minimizes exposure to this specific class of memory corruption vulnerabilities.