SignalWire FreeSWITCH up to 1.11.1 WebSocket ws_read_frame datalen out-of-bounds write

Summaryinfo

A vulnerability categorized as problematic has been discovered in SignalWire FreeSWITCH up to 1.11.1. This affects the function ws_read_frame of the component WebSocket. Such manipulation of the argument datalen leads to out-of-bounds write. This vulnerability is uniquely identified as CVE-2026-116781. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in SignalWire FreeSWITCH up to 1.11.1. Affected by this issue is the function ws_read_frame of the component WebSocket. The manipulation of the argument datalen with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is integrity. CVE summarizes:

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() unmasked a WebSocket payload by iterating wsh->datalen, which included frame headers, while indexing from the payload pointer. A masked frame filling the 64 KiB receive buffer could therefore XOR up to 14 bytes beyond the buffer, and the exact-capacity case also wrote a terminating NUL one byte out of bounds. The flaw is reachable before authentication when mod_xml_rpc and its opt-in WebSocket endpoint are enabled, while both features are disabled in the stock configuration. The writes remain within the same connection handle's adjacent outbound buffer, so neither a process crash nor cross-session disclosure has been demonstrated. This issue is fixed in version 1.11.2.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-116781 since 10/26/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

Upgrading to version 1.11.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• SignalWire

Name

• FreeSWITCH

Version

• 1.11.0
• 1.11.1

Website

• Product: https://github.com/signalwire/freeswitch/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion