CVE-2026-116780: FreeSWITCH: Heap out-of-bounds read in FreeSWITCH core variable expansion via `${variable:offset}` slicing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, switcheventexpandheaderscheck() advanced beyond its heap copy when a positive offset in ${variable:offset} exceeded the variable value's length. The following length calculation and copy appended adjacent heap memory to the expansion result, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The flaw is reachable through configuration templates that slice remote input and through authenticated Event Socket eval or Event Socket expand commands; the separate channel-variable expander used by ordinary dialplan slicing is unaffected. The requester cannot choose adjacent memory and disclosure stops at a zero byte, but repeated expansion can influence the layout. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which FreeSWITCH uses are exposed to this issue?
The affected expansion path is reachable through configuration templates that apply slicing to remote input and through authenticated Event Socket eval or Event Socket expand commands. Ordinary dialplan slicing uses a separate channel-variable expander and is not affected.
What must an attacker be able to do to trigger the disclosure?
An attacker must be able to cause a positive offset larger than a variable value's length in the affected expansion path. This can occur by influencing remote input processed by a slicing template, or by having authenticated access to the relevant Event Socket commands.
What information could be disclosed?
The expansion result can include adjacent heap memory, potentially exposing channel variables, credentials, allocator data, and pointer bytes. The requester cannot select the adjacent memory to disclose, and disclosure ends at a zero byte.
How can exposure be reduced before updating?
Avoid configuration templates that slice remote input through the affected expansion path, and restrict authenticated access to Event Socket eval and expand commands. Update to FreeSWITCH 1.11.2, which fixes the issue.
How can an operator identify potentially affected deployments?
Review FreeSWITCH versions prior to 1.11.2 for configuration templates that use variable slicing on remote input and for use of authenticated Event Socket eval or expand commands. Ordinary dialplan slicing alone does not indicate exposure to this flaw.