CVE-2026-116781 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket payload by iterating wsh->datalen, which included frame headers, while indexing from the payload pointer. A masked frame filling the 64 KiB receive buffer could therefore XOR up to 14 bytes beyond the buffer, and the exact-capacity case also wrote a terminating NUL one byte out of bounds. The flaw is reachable before authentication when mod_xml_rpc and its opt-in WebSocket endpoint are enabled, while both features are disabled in the stock configuration. The writes remain within the same connection handle's adjacent outbound buffer, so neither a process crash nor cross-session disclosure has been demonstrated. This issue is fixed in version 1.11.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a comprehensive software-defined telecom stack designed to facilitate the migration from proprietary hardware switches to flexible software implementations running on commodity hardware. Within this architecture, WebSocket support allows for real-time communication and control via web-based interfaces. However, prior to version 1.11.2, the implementation of the ws_read_frame function contained a critical memory safety flaw related to how it handled masked payloads in WebSocket frames. The vulnerability stems from an incorrect calculation of the data length during the unmasking process. Specifically, the function iterated over wsh->datalen, which erroneously included frame headers rather than just the payload data itself. By indexing directly into the payload pointer while using this inflated length value, the code attempted to access memory beyond the intended buffer boundaries when processing masked frames that filled the 64 KiB receive buffer.
The technical mechanics of this flaw result in an out-of-bounds write operation. When a maliciously crafted WebSocket frame with masking enabled fills the entire receive buffer, the XOR unmasking loop proceeds past the end of the allocated memory region. In scenarios where the payload exactly matches the buffer capacity, the function writes up to fourteen bytes beyond the allocated heap space due to the inclusion of header lengths in the iteration count. Furthermore, even in cases where the data length is calculated correctly for exact-capacity frames, a terminating null byte is written one byte past the end of the buffer. This constitutes an off-by-one error that violates standard memory safety boundaries, potentially corrupting adjacent heap metadata or application state structures depending on how the allocator manages free chunks and allocation headers.
From a security impact perspective, this vulnerability presents a nuanced risk profile due to its specific reachability conditions. The flaw is accessible before authentication if mod_xml_rpc is enabled along with its optional WebSocket endpoint feature set. However, it is important to note that both of these features are disabled by default in the stock FreeSWITCH configuration, which significantly reduces the attack surface for typical deployments. While the out-of-bounds writes remain within the memory space associated with the same connection handle's adjacent outbound buffer, preventing immediate process crashes or cross-session data disclosure from being demonstrated, such heap corruption remains dangerous. It can lead to undefined behavior, potential denial of service through subsequent allocation failures, or in more complex exploitation scenarios involving heap grooming techniques, it could potentially be leveraged for arbitrary code execution by manipulating the corrupted memory structures to redirect control flow.
This vulnerability aligns with CWE-787: Out-of-bounds Write and CWE-193: Off-by-One Error, reflecting fundamental flaws in buffer boundary validation during data processing operations. In terms of adversarial tactics, this issue relates to ATT&CK technique T1059: Command and Scripting Interpreter if the WebSocket interface is used for remote management, although the primary vector here is memory corruption rather than direct command execution. The exploitation requires network access to the vulnerable endpoint, placing it within the context of initial access or privilege escalation depending on whether authentication bypasses are combined with this flaw.
To mitigate this risk, organizations running FreeSWITCH should immediately upgrade to version 1.11.2 or later, where the ws_read_frame function has been corrected to accurately calculate payload lengths excluding frame headers and ensure all writes remain strictly within allocated buffer boundaries. For environments that cannot update immediately due to compatibility constraints, it is critical to verify that mod_xml_rpc and its WebSocket endpoint are explicitly disabled in the configuration files if they are not required for business operations. Additionally, deploying network-level access controls such as firewalls or reverse proxies can restrict direct access to these endpoints from untrusted networks, thereby reducing exposure until a permanent patch can be applied. Regular security audits of telecom stack configurations should also include verification that optional features with external-facing interfaces are disabled unless absolutely necessary, adhering to the principle of least privilege in system configuration.