CVE-2026-116788 in FreeSWITCH
Summary
by MITRE • 11/05/2026
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/05/2026
FreeSWITCH serves as a widely deployed open-source telecommunications platform designed to handle real-time communication protocols such as SIP. The software processes complex signaling messages and XML-based data structures for features like presence management, which requires parsing external entities defined in Document Type Definitions (DTDs). In versions prior to 1.11.2, the core component responsible for decoding XML content, specifically the switch_xml_decode function, contains a critical logic flaw related to integer arithmetic handling. This vulnerability arises when an attacker provides a crafted SIP PUBLISH request that includes an entity declaration with an empty replacement value. The parsing engine fails to correctly account for the size of this empty string during memory allocation calculations, leading to an integer underflow condition where the calculated buffer size becomes erroneously small or wraps around to a minimal positive number rather than reflecting the actual required space or handling the zero-length case appropriately.
The technical consequence of this integer underflow is that switch_xml_decode allocates a heap buffer that is significantly smaller than what will subsequently be written into it. When the system proceeds to copy data associated with the entity replacement, even if minimal, the operation exceeds the bounds of the allocated memory region. This results in a classic heap-based buffer overflow where adjacent memory structures are overwritten or corrupted. Because this processing occurs within the main event loop handling SIP signaling, the corruption affects critical internal state variables and control flow pointers stored on the heap. The immediate operational impact is severe instability; the FreeSWITCH process typically crashes due to segmentation faults triggered by accessing invalid memory addresses during subsequent operations. This crash results in a complete denial of service for all active calls routed through that specific instance, effectively disrupting telephony services for any users connected at that time.
From an exploitation perspective, this vulnerability is particularly dangerous because it can be triggered remotely without authentication if the FreeSWITCH server has presence management enabled and DTD processing permitted on its SIP profiles. An unauthenticated attacker located anywhere with network access to the vulnerable port can craft a malicious PUBLISH message containing the specific XML entity structure that induces the underflow. The attack does not require code execution privileges or prior interaction, making it an attractive vector for distributed denial-of-service attacks against VoIP infrastructure providers and enterprise communication systems. The ability to crash the service remotely with minimal payload complexity underscores the severity of improper input validation in security-critical parsing libraries used by telephony software.
To mitigate this risk, organizations running FreeSWITCH must immediately upgrade to version 1.11.2 or later, where the integer underflow logic has been corrected and proper bounds checking is implemented during XML entity decoding. For environments that cannot patch immediately due to operational constraints, a temporary mitigation involves disabling DTD processing entirely within the SIP profile configuration if presence management features are not strictly required for business operations. Disabling external entity resolution prevents the parser from encountering the specific malformed structures needed to trigger the vulnerability. Additionally, deploying network-level intrusion prevention systems capable of inspecting SIP payloads may help block crafted PUBLISH requests containing suspicious XML patterns before they reach the FreeSWITCH application layer.
This vulnerability is categorized under CWE-190 Integer Overflow or Wraparound and CWE-787 Out-of-bounds Write in the Common Weakness Enumeration database, reflecting its root cause and exploitation mechanism respectively. In terms of tactical classification within the MITRE ATT&CK framework, this exploit aligns with T1499 Endpoint Denial of Service, as it aims to disrupt service availability rather than steal data or gain persistent access. The reliance on SIP signaling protocols places it firmly in the context of network-based attacks against communication infrastructure, highlighting the importance of securing VoIP endpoints and servers against malformed message injection.