CVE-2026-116783: FreeSWITCH mod_spandsp: out-of-bounds write parsing UDPTL error-recovery data
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, udptlrxpacket() used a peer-controlled FEC entry count directly to fill five-entry FEC arrays in a modspandsp T.38 session. A larger count wrote sender-controlled error-recovery data beyond those arrays and persisted the oversized count for a later reconstruction pass. Any peer able to deliver UDPTL to an established T.38 fax session can reach the parser, including deployments using fax applications or a T.38 gateway. The memory corruption can crash FreeSWITCH and end every active call, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCH mod_spandspto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments that use mod_spandsp for T.38 fax sessions, including fax applications or a T.38 gateway, are exposed if a peer can deliver UDPTL to an established T.38 session. The issue affects FreeSWITCH versions prior to 1.11.2.
What does an attacker need to exploit this issue?
An attacker needs to be able to send UDPTL traffic to an established T.38 fax session. No authentication or user interaction is required according to the provided severity vector.
What is the likely impact?
Sender-controlled error-recovery data can corrupt memory and crash FreeSWITCH, ending every active call. Remote code execution has not been demonstrated.
What should be done if immediate patching is not possible?
Restrict UDPTL delivery to trusted peers and avoid exposing established T.38 fax sessions to untrusted sources where possible. Upgrade to FreeSWITCH 1.11.2 when feasible.