CVE-2026-116574: FreeSWITCH: Off-by-one heap write in core XML serialization of four-byte UTF-8 sequences
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switchxmlampencode() reserved only ten bytes for the widest numeric character reference produced from a four-byte UTF-8 sequence, omitting space for the terminating NUL. When remote-supplied text was serialized at the exact buffer-growth boundary, the terminator wrote one byte beyond the heap allocation. Reachable surfaces include modxmlcdr, conference and formatted CDR XML, XML Event Socket output, and XML API output that serializes caller-controlled values. The fixed zero-byte write can abort the process or truncate an adjacent object, while remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are most likely to be exposed?
Deployments that serialize caller-controlled values through mod_xml_cdr, conference or formatted CDR XML, XML Event Socket output, or XML API output are the identified reachable surfaces. The issue requires remote-supplied text to be serialized on one of these paths.
What conditions are required to trigger the overflow?
A four-byte UTF-8 sequence must be processed by switch_xml_ampencode() when the output lands at the exact buffer-growth boundary. The resulting terminating NUL byte is written one byte beyond the heap allocation.
What impact has been demonstrated?
The fixed zero-byte heap write can abort the FreeSWITCH process or truncate an adjacent heap object. Remote code execution has not been demonstrated.
Which versions need remediation?
Versions before 1.11.2 are affected. The issue is fixed in FreeSWITCH 1.11.2.