CVE-2026-116788: FreeSWITCH: Pre-authentication heap buffer overflow in core XML empty-entity decoding
FreeSWITCH is an open-source software telecommunications platform. Before version 1.11.2, an integer underflow in switchxmldecode() can cause an undersized heap allocation when an XML document declares an entity with an empty replacement value. Subsequent copying overruns the allocated buffer. An unauthenticated attacker who can reach a SIP profile with presence management enabled and DTD processing permitted can trigger the vulnerability through a crafted SIP PUBLISH request. Exploitation can corrupt heap memory and terminate the FreeSWITCH process, interrupting all active calls. This vulnerability is fixed in version 1.11.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeSWITCHto a version that resolves this vulnerability.Fixed in 1.11.2
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
FreeSWITCH deployments before 1.11.2 are exposed if an attacker can reach a SIP profile that has presence management enabled and permits DTD processing. The attack does not require authentication or user interaction.
What is the likely operational impact of a successful attack?
A crafted SIP PUBLISH request can corrupt heap memory and terminate the FreeSWITCH process. This can interrupt all active calls.
How can I remediate this issue?
Upgrade FreeSWITCH to version 1.11.2, which contains the fix.