CVE-2026-115928: FreeSWITCH: Stack buffer overflow parsing the SDP a=crypto key material on inbound calls
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switchcoremediaaddcrypto() passed the encoded key and salt length from an inbound SDP a=crypto attribute to switchb64decode() as the destination capacity. A zero-length key and salt made that capacity underflow, allowing the decoded attribute to overflow a fixed stack buffer with sender-chosen bytes before the call was answered. On the shipped external profile, an unauthenticated caller can reach the SDES-SRTP parser, while profiles that challenge inbound calls remain affected for senders who can authenticate; setting rtpsecuremediainbound to false removes the path, and WebRTC DTLS-SRTP legs are unaffected. The overflow corrupts memory and can crash the FreeSWITCH process, dropping every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2 - Configuration
Set rtp_secure_media_inbound to false to remove the vulnerable SDES-SRTP parsing path.
FreeSWITCH rtp_secure_media_inbound = false
Event History
Frequently Asked Questions
Which FreeSWITCH deployments can be exploited without authentication?
Deployments using the shipped external profile are reachable by an unauthenticated caller because that profile exposes the SDES-SRTP parser on inbound calls. Profiles that challenge inbound calls require the sender to authenticate first.
Are WebRTC calls affected?
WebRTC legs using DTLS-SRTP are unaffected. The vulnerable path is the SDES-SRTP a=crypto parsing on inbound SDP.
What can be done if upgrading is not immediately possible?
Set rtp_secure_media_inbound to false to remove the vulnerable parsing path. This mitigation disables inbound secure-media handling through that setting.
How serious is successful exploitation in practice?
The overflow can corrupt memory and crash the FreeSWITCH process, dropping all active calls. Remote code execution has not been demonstrated.
What version fixes the issue?
The issue is fixed in FreeSWITCH version 1.11.2. Versions prior to 1.11.2 are affected when the vulnerable SDES-SRTP inbound path is enabled.