CVE-2026-116573: FreeSWITCH mod_sofia: stack buffer overflow from an over-long SIP To-header user
FreeSWITCH is an open-source software telecommunications platform. From 1.10.0 until 1.11.1, a stack-based buffer overflow in modsofia when generating dialog-event notifications. A peer can establish a dialog with an excessively long SIP To-header user part and subsequently subscribe to that entity’s dialog events, causing the stored value to overflow a fixed-size stack buffer. Exploitation requires presence or shared-appearance management to be enabled and normally requires valid profile credentials, unless subscription authentication is disabled. The overflow can terminate the FreeSWITCH process and all active calls. This vulnerability is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCH mod_sofiato a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using FreeSWITCH versions from 1.10.0 through 1.11.1 are affected when mod_sofia is configured with presence or shared-appearance management enabled.
What does an attacker need to exploit this?
An attacker must establish a dialog using an excessively long user portion in the SIP To header and then subscribe to dialog events for that entity. Valid profile credentials are normally required, but they may not be needed if subscription authentication is disabled.
What is the practical impact?
The stack buffer overflow can terminate the FreeSWITCH process, interrupting all active calls. The provided information describes an availability impact and does not identify confidentiality or integrity impact.
What should be done if an immediate upgrade is not possible?
Ensure subscription authentication is enabled and restrict valid profile credentials to trusted users. If operationally feasible, disable presence or shared-appearance management until the system can be updated.
How can I remediate this issue?
Upgrade FreeSWITCH to version 1.11.2, which fixes the vulnerability.