CVE-2026-116781: FreeSWITCH: Pre-authentication out-of-bounds writes in mod_xml_rpc WebSocket frame parsing
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe() unmasked a WebSocket payload by iterating wsh->datalen, which included frame headers, while indexing from the payload pointer. A masked frame filling the 64 KiB receive buffer could therefore XOR up to 14 bytes beyond the buffer, and the exact-capacity case also wrote a terminating NUL one byte out of bounds. The flaw is reachable before authentication when modxmlrpc and its opt-in WebSocket endpoint are enabled, while both features are disabled in the stock configuration. The writes remain within the same connection handle's adjacent outbound buffer, so neither a process crash nor cross-session disclosure has been demonstrated. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue is reachable only when both mod_xml_rpc and its opt-in WebSocket endpoint are enabled. The stock FreeSWITCH configuration is not affected because both features are disabled by default.
Does an attacker need credentials or prior access?
No. A remote attacker can reach the vulnerable frame parsing path before authentication when the affected WebSocket endpoint is enabled.
What is the practical impact described for this flaw?
A masked WebSocket frame can cause out-of-bounds writes of up to 14 bytes beyond the 64 KiB receive buffer, with an additional one-byte terminating-NUL write in the exact-capacity case. The writes remain in the same connection handle's adjacent outbound buffer; process crashes and cross-session disclosure have not been demonstrated.
How can I remediate the issue?
Upgrade FreeSWITCH to version 1.11.2. If upgrading is not immediately possible, disable mod_xml_rpc or its WebSocket endpoint to remove the pre-authentication attack path.