CVE-2026-116572: FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP Contact display-name
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 to 1.11.1, there is a stack-based buffer overflow in modsofia when processing SIP Contact display names for dialog-event notifications. A peer can establish a dialog containing an excessively long display name and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed 512-byte stack buffer. Exploitation requires presence management to be enabled, directly or through shared appearance, and normally requires valid profile credentials unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCH mod_sofiato a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeSWITCH versions 1.10.0 through 1.11.1 are affected when mod_sofia processes dialog-event notifications and presence management is enabled, including through shared appearance. Deployments without presence management enabled are not described as meeting the exploitation conditions.
What access does an attacker need?
An attacker needs to establish a dialog with an excessively long SIP Contact display name and then subscribe to that entity's dialog events. Valid profile credentials are normally required, unless subscription authentication has been disabled.
What is the likely impact of successful exploitation?
The stack buffer overflow can terminate the FreeSWITCH process, disrupting all active calls. The provided information describes an availability impact and does not identify confidentiality or integrity impact.
What should be done if upgrading cannot happen immediately?
Ensure subscription authentication is enabled and restrict profile credentials to trusted peers. If operationally feasible, disable presence management or shared appearance until the affected system can be upgraded.
How can I remediate the vulnerability?
Upgrade FreeSWITCH to version 1.11.2, which fixes the issue.