CVE-2026-116785: FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, wsreadframe() decoded a WebSocket frame's 64-bit extended payload length with a 32-bit byte swap and narrowed the result into a signed length. A value whose surviving low word became negative bypassed the signed size check and was reinterpreted as an enormous unsigned count, causing client bytes to overwrite memory beyond the 64 KiB receive buffer. Any client completing a /socket WebSocket upgrade on an enabled modxmlrpc endpoint reached the parser before HTTP authentication; both the module and WebSocket endpoint are disabled by default. The heap overwrite can corrupt connection pointers and crash FreeSWITCH, ending every concurrent session, although remote code execution has not been demonstrated. This issue is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed only if mod_xml_rpc is enabled and its /socket WebSocket endpoint is enabled. Both are disabled by default, so installations that have not enabled them are not affected through this path.
Does an attacker need credentials or an existing session?
No. Any remote client that can complete a WebSocket upgrade to the enabled /socket endpoint can reach the vulnerable parser before HTTP authentication.
What is the practical impact?
The heap overwrite can corrupt connection pointers and crash FreeSWITCH, terminating all concurrent sessions. Remote code execution has not been demonstrated.
What can be done if upgrading is not immediately possible?
Disable mod_xml_rpc or disable its /socket WebSocket endpoint to remove the affected attack path. The issue is fixed in FreeSWITCH 1.11.2.