CVE-2026-116780 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switch_event_expand_headers_check() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value's length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a critical software-defined telecommunications stack that facilitates the migration from proprietary hardware switches to flexible software implementations running on commodity hardware. Within this architecture, efficient and secure handling of channel variables and event data is paramount for maintaining system integrity and confidentiality. A significant vulnerability was identified in versions prior to 1.11.2 involving the function switch_event_expand_headers_check(). This component is responsible for processing variable expansions within events, a process essential for dynamic configuration and real-time communication control. The flaw manifests when a positive offset specified via the ${variable:offset} syntax exceeds the length of the target variable's value. Instead of terminating or returning an error as expected, the function advances its pointer beyond the bounds of the allocated heap copy associated with that variable.
The technical core of this vulnerability lies in improper boundary checking during memory operations. When the offset calculation results in a position past the end of the source string, the subsequent length determination and data copying logic erroneously appends adjacent heap memory to the expansion result. This out-of-bounds read allows an attacker to access sensitive information stored in neighboring memory regions. The disclosed data can include channel variables containing session-specific context, credentials such as authentication tokens or passwords, allocator metadata used by the system's memory management subsystem, and potentially pointer bytes that could aid in further exploitation attempts like return-oriented programming attacks. This behavior constitutes a classic out-of-bounds read vulnerability, categorized under CWE-125: Out-of-bounds Read in industry standards.
The operational impact of this flaw is primarily information disclosure, which can lead to severe confidentiality breaches within the telecommunications infrastructure. An attacker capable of triggering this condition can extract sensitive internal state data that should remain isolated from external inputs. The vulnerability is reachable through specific attack vectors including configuration templates that slice remote input and authenticated Event Socket commands such as eval or expand. These interfaces allow users to manipulate variable expansions, providing a pathway for exploitation if proper authentication controls are bypassed or compromised. It is important to note that the separate channel-variable expander used by ordinary dialplan slicing remains unaffected, limiting the scope of exposure primarily to event socket interactions and specific template processing paths.
Although the attacker cannot arbitrarily choose which adjacent memory bytes are disclosed due to the sequential nature of heap allocation and the fact that disclosure stops at a zero byte, repeated expansion attempts can influence the layout of heap data over time. This potential for influencing memory layout increases the risk profile by possibly aligning sensitive structures in predictable ways or causing instability through inconsistent state changes. The vulnerability is classified under MITRE ATT&CK technique T1083: File and Directory Discovery, as it enables an attacker to discover information about the system's internal structure and stored credentials without direct file access.
To mitigate this risk, organizations running FreeSWITCH must upgrade to version 1.11.2 or later where the boundary checks have been corrected to prevent reading beyond allocated buffers. In addition to patching, administrators should enforce strict authentication policies on Event Socket interfaces to ensure that only authorized entities can execute eval and expand commands. Monitoring for unusual patterns in variable expansion requests may also help detect attempted exploitation activities before significant data leakage occurs. Regular security audits of configuration templates are recommended to identify any logic that might inadvertently expose internal variables through improper slicing operations.