SignalWire FreeSWITCH up to 1.11.1 mod_xml_rpc ws_read_frame buffer overflow

Summaryinfo

A vulnerability identified as very critical has been detected in SignalWire FreeSWITCH up to 1.11.1. This vulnerability affects the function ws_read_frame of the component mod_xml_rpc. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2026-116785. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in SignalWire FreeSWITCH up to 1.11.1. This affects the function ws_read_frame of the component mod_xml_rpc. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() decoded a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap and narrowed the result into a signed length. A value whose surviving low word became negative bypassed the signed size check and was reinterpreted as an enormous unsigned count, causing client bytes to overwrite memory beyond the 64 KiB receive buffer. Any client completing a /socket WebSocket upgrade on an enabled mod_xml_rpc endpoint reached the parser before HTTP authentication; both the module and WebSocket endpoint are disabled by default. The heap overwrite can corrupt connection pointers and crash FreeSWITCH, ending every concurrent session, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-116785 since 10/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/05/2026).

Upgrading to version 1.11.2 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• SignalWire

Name

• FreeSWITCH

Version

• 1.11.0
• 1.11.1

Website

• Product: https://github.com/signalwire/freeswitch/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion