HIGH 8.2 NVD
CVE-2026-116788
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switch_xml_decode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.
References
- https://github.com/signalwire/freeswitch/commit/587474a1584488f0c04201e6e61efe76aa5bda01
- https://github.com/signalwire/freeswitch/releases/tag/v1.11.2
- https://github.com/signalwire/freeswitch/security/advisories/GHSA-f73w-xph4-pjp3
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-11-05 via NVD.
vulnfeed aggregates 16809 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.